Virtual Architects Support Wiki

User Tools

Site Tools

You are here: start » computing » linux » graylog
Trace:
computing:linux:graylog

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
computing:linux:graylog [2021/08/23 12:34]
gcooper 		computing:linux:graylog [2022/01/18 11:05] (current)
gcooper
Line 1: Line 1:
 ====== Syslog with Graylog ====== ====== Syslog with Graylog ======
- 
-FIXME Unfinished 
  
 **Excellent Documentation**: https://docs.graylog.org/en/4.1/index.html **Excellent Documentation**: https://docs.graylog.org/en/4.1/index.html
Line 30: Line 28:
  
 **Archived data is stored in a compressed format on the Graylog server** or network file share. It is searchable via GREP, but must be reconstituted in Graylog in order to be searchable through the GUI again. **Archived data is stored in a compressed format on the Graylog server** or network file share. It is searchable via GREP, but must be reconstituted in Graylog in order to be searchable through the GUI again.
 +
 +===== Upgrade =====
 +
 +We use ''apt'' repositories for installation, so updates are easy:
 +
 +Show all ''apt'' sources:
 +
 +<file>
 +grep -r --include '*.list' '^deb ' /etc/apt/sources.list*
 +</file>
 +
 +<file>
 +apt update && apt dist-upgrade -y && apt autoremove -y && apt clean && reboot
 +</file>
  
 ===== Configuration ===== ===== Configuration =====
Line 39: Line 51:
 ==== Syslog Input ==== ==== Syslog Input ====
  
-The first step to accept input is to create an ''Input'' (listener), probably syslog UDP and TCP.+The first step to accept input is to create an ''Input'' (listener), perhaps "Syslog UDP".
  
 It is recommended to configure the syslog ''Input'' to accept traffic on **UDP port 1514** and redirect traffic sent to UDP 514 to it. It is recommended to configure the syslog ''Input'' to accept traffic on **UDP port 1514** and redirect traffic sent to UDP 514 to it.
Line 58: Line 70:
 ==== Create Stream ==== ==== Create Stream ====
  
-Stream Rules route messages into indexes.+Stream Rules route or sort messages into indexes.
  
 ===== Log Sources ===== ===== Log Sources =====
computing/linux/graylog.1629743672.txt.gz · Last modified: 2021/08/23 12:34 by gcooper

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki