Virtual Architects Support Wiki

User Tools

Site Tools

You are here: start » computing » linux » graylog
Trace:
computing:linux:graylog

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
computing:linux:graylog [2021/08/23 11:27]
gcooper 		computing:linux:graylog [2022/01/18 11:05] (current)
gcooper
Line 1: Line 1:
 ====== Syslog with Graylog ====== ====== Syslog with Graylog ======
- 
-FIXME Unfinished 
  
 **Excellent Documentation**: https://docs.graylog.org/en/4.1/index.html **Excellent Documentation**: https://docs.graylog.org/en/4.1/index.html
Line 30: Line 28:
  
 **Archived data is stored in a compressed format on the Graylog server** or network file share. It is searchable via GREP, but must be reconstituted in Graylog in order to be searchable through the GUI again. **Archived data is stored in a compressed format on the Graylog server** or network file share. It is searchable via GREP, but must be reconstituted in Graylog in order to be searchable through the GUI again.
 +
 +===== Upgrade =====
 +
 +We use ''apt'' repositories for installation, so updates are easy:
 +
 +Show all ''apt'' sources:
 +
 +<file>
 +grep -r --include '*.list' '^deb ' /etc/apt/sources.list*
 +</file>
 +
 +<file>
 +apt update && apt dist-upgrade -y && apt autoremove -y && apt clean && reboot
 +</file>
  
 ===== Configuration ===== ===== Configuration =====
Line 39: Line 51:
 ==== Syslog Input ==== ==== Syslog Input ====
  
-The first step to accept input is to create an ''Input'', probably syslog UDP and TCP.+The first step to accept input is to create an ''Input'' (listener), perhaps "Syslog UDP".
  
 It is recommended to configure the syslog ''Input'' to accept traffic on **UDP port 1514** and redirect traffic sent to UDP 514 to it. It is recommended to configure the syslog ''Input'' to accept traffic on **UDP port 1514** and redirect traffic sent to UDP 514 to it.
Line 52: Line 64:
 See also **[[networking:firewall:csf|https://virtualarchitects.com/wiki/doku.php?id=networking:firewall:csf]]**</note> See also **[[networking:firewall:csf|https://virtualarchitects.com/wiki/doku.php?id=networking:firewall:csf]]**</note>
  
-=== Send Linux Syslog ===+==== Create Index ==== 
 + 
 +Indexes are how data is stored and rotated. 
 + 
 +==== Create Stream ==== 
 + 
 +Stream Rules route or sort messages into indexes. 
 + 
 +===== Log Sources ===== 
 + 
 +==== Send Linux Syslog ====
  
 https://github.com/Graylog2/graylog-guide-syslog-linux/ https://github.com/Graylog2/graylog-guide-syslog-linux/
computing/linux/graylog.1629739626.txt.gz · Last modified: 2021/08/23 11:27 by gcooper

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki