Hi Jochen, After swittching the receiver to 1514, and a reboot, the server is receiving messages now. However, when I change the user back to "graylog", and restart, after about 1 minute, it crashes with 1000's of errors. Swithing back to root fixes it. I think I should reload the server and app.
Thanks for all your help! Jason On Sun, Jan 22, 2017 at 9:51 PM, Jason Fuller <djasonful...@gmail.com> wrote: > Hi Jochen, > > Understand about the security implications. Thank you for pointing out ;) > > On the receipt issue, yes, I'm sure there is not a network issue, on the > graylog server I'm receiving the packet. It's just not showing up in > Graylog: > > [root@server]# tcpdump -nnvvi ens32 port 514 > tcpdump: listening on ens32, link-type EN10MB (Ethernet), capture size > 65535 bytes > 05:54:04.456723 IP (tos 0x0, ttl 64, id 8493, offset 0, flags [DF], proto > UDP (17), length 127) > 10.10.0.5.37136 > 10.10.0.64.514: [udp sum ok] SYSLOG, length: 99 > Facility user (1), Severity info (6) > Msg: Jan 22 21:46:40 SERVER01 System Test message from Synology > Syslog Client from (10.10.0.5)\0x0a > 0x0000: 3c31 343e 4a61 6e20 3232 2032 313a 3436 > 0x0010: 3a34 3020 504e 4153 4148 3149 4e46 3031 > 0x0020: 2053 7973 7465 6d20 5465 7374 206d 6573 > 0x0030: 7361 6765 2066 726f 6d20 5379 6e6f 6c6f > 0x0040: 6779 2053 7973 6c6f 6720 436c 6965 6e74 > 0x0050: 2066 726f 6d20 2831 302e 3230 382e 302e > 0x0060: 3529 0a > ^C > 1 packet captured > 1 packet received by filter > 0 packets dropped by kernel > > Thank you for your help, > Regards, > Jason > > > On Sun, Jan 22, 2017 at 8:02 PM, Jochen Schalanda <joc...@graylog.com> > wrote: > >> On Sunday, 22 January 2017 12:54:20 UTC+1, Jochen Schalanda wrote: >>> >>> On Sunday, 22 January 2017 06:19:21 UTC+1, JayJay wrote: >>>> >>>> Changed user to root, restarted server, and the input is starting ok >>>> now. >>>> >>> >>> From a security perspective, that's a very bad idea and I'd recommend to >>> use one of the other mechanisms described in the documentation: >>> http://docs.graylog.org/en/2.1/pages/faq.html >>> #how-can-i-start-an-input-on-a-port-below-1024 >>> >> >> The simplest thing would be to run the input on a port >1024 (e. g. 1514) >> of course… >> >> -- >> You received this message because you are subscribed to a topic in the >> Google Groups "Graylog Users" group. >> To unsubscribe from this topic, visit https://groups.google.com/d/to >> pic/graylog2/1MF1mFj6EhQ/unsubscribe. >> To unsubscribe from this group and all its topics, send an email to >> graylog2+unsubscr...@googlegroups.com. >> To view this discussion on the web visit https://groups.google.com/d/ms >> gid/graylog2/df11f552-c742-4858-838f-ea1c74c02ced%40googlegroups.com >> <https://groups.google.com/d/msgid/graylog2/df11f552-c742-4858-838f-ea1c74c02ced%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> >> For more options, visit https://groups.google.com/d/optout. >> > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/CAGUPOFt1Es%2BX1YigioxFFEVhLEwwSZhtosC8EZ0qho1A%3DtOeXw%40mail.gmail.com. For more options, visit https://groups.google.com/d/optout.
