Ask questions. Get answers. Find technical product solutions from passionate experts in the NXLog community.
Need help please. Best way to receive rsyslog from clients and forward onto a Graylog server?
jerald.harrison created
I have my NXlog server successfully receiving rsyslog messages from client Linux boxes. Now I'm trying to have NXlog forward those messages to my Graylog server using GELF.
NXlog and Graylog are both running on CentOS 7
If anyone can point me in the right direction config file wise I'd be greatly appreciative.
jerald.harrison created
ERROR om_tcp detected a connection error;Connection reset by peer
jmcgranahan created
I am attempting to use NXLog in conjunction with Graylog's Sidecar Collector to send data to my Graylog server. I have been able to successfully telnet to my Graylog server through port 5044, so I know it is not a firewall issue, yet I keep getting these errors in my NXLog error log:
2017-11-08 14:37:09 ERROR om_tcp detected a connection error;Connection reset by peer
2017-11-08 14:37:25 ERROR om_tcp detected a connection error;End of file found
And nothing is being received by my Graylog server.
Here is my generated NXLog configuration:
define ROOT /usr/bin
<Extension gelf>
Module xm_gelf
</Extension>
User nxlog
Group nxlog
Moduledir /usr/libexec/nxlog/modules
CacheDir /var/spool/collector-sidecar/nxlog
PidFile /var/run/graylog/collector-sidecar/nxlog.pid
define LOGFILE /var/log/graylog/collector-sidecar/nxlog.log
LogFile %LOGFILE%
LogLevel DEBUG
<Extension logrotate>
Module xm_fileop
<Schedule>
When @daily
Exec file_cycle('%LOGFILE%', 7);
</Schedule>
</Extension>
<Input 59fcda86ccba8e2573422cb4>
Module im_file
File '/var/log/httpd/syriac_access_log'
PollInterval 1
SavePos True
ReadFromLast True
Recursive True
RenameCheck False
Exec $FileName = file_name(); # Send file name with each message
</Input>
<Output 59fcda56ccba8e2573422c80>
Module om_tcp
Host graylog.library.vanderbilt.edu
Port 5044
OutputType GELF_TCP
Exec $short_message = $raw_event; # Avoids truncation of the short_message field.
Exec $gl2_source_collector = '485f3ca7-ca1e-4959-be00-117a50e2b1db';
Exec $collector_node_id = 'graylog-collector-sidecar';
Exec $Hostname = hostname_fqdn();
</Output>
<Route route-0>
Path 59fcda86ccba8e2573422cb4 => 59fcda56ccba8e2573422c80
</Route>
I would appreciate any advice or guidance. Thank you!
jmcgranahan created