將NXLog連接到Graylog2

我已經通過NXlog將日誌成功發送到Graylog2。但是，NXlog和Graylog2都運行在同一臺服務器上。現在我想通過NXlog將日誌從另一臺服務器發送到Graylog2，但根本沒有工作。你能幫我解決嗎？這是我的NXlog配置：將NXLog連接到Graylog2

User i_cdp 
Group int 

Panic Soft 

#define CERTDIR /opt/cdp/nxlog/opt/var/lib/nxlog/cert 
define CONFDIR /opt/cdp/nxlog/opt/var/lib/nxlog 
define LOGDIR /opt/cdp/nxlog/opt/var/log/nxlog 
define LOGFILE "%LOGDIR%/nxlog.log" 

SpoolDir /opt/cdp/nxlog/opt/var/spool/nxlog 

# default values: 
PidFile /opt/cdp/nxlog/opt/var/run/nxlog/nxlog.pid 
CacheDir /opt/cdp/nxlog/opt/var/spool/nxlog 
ModuleDir /opt/cdp/nxlog/opt/libexec/nxlog/modules 

<Extension _syslog> 
    Module  xm_syslog 
</Extension> 


<Extension gelf> 
    Module  xm_gelf 
</Extension> 

<Input in> 
    Module  im_file 
    File  "/opt/cdp/jboss-eap/jboss/standalone/log/*.log*" 
    Exec if $raw_event =~ /(\d\d\d\d\-\d\d-\d\d \d\d:\d\d:\d\d)/ $EventTime = parsedate($1); 
    Exec $Hostname = 'bsul0850'; 
    Exec if $raw_event =~ /ERROR/ $SyslogSeverityValue = 3; \ 
    else $SyslogSeverityValue = 6; 
    Exec $FileName = file_name(); 
    Exec if $raw_event =~ /WARN/ $Message = 'IMPORTANT!! ' + $raw_event; 
    Exec $SourceName = 'jboss'; 
</Input> 


<Output out> 
    Module om_udp 
    Host 10.41.66.84 
    Port 12009 
    OutputType GELF 
</Output> 


<Route r1> 
    Path  in => out 
</Route> 

<Extension _charconv> 
    Module  xm_charconv 
    AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32 
</Extension> 

<Extension _exec> 
    Module  xm_exec 
</Extension> 

<Extension _fileop> 
    Module  xm_fileop 
    # Check the size of our log file every hour and rotate if it is larger than 5Mb 
    <Schedule> 
     Every 1 hour 
     Exec if (file_exists(%LOGFILE%) and (file_size(%LOGFILE%) >= 5M)) file_cycle(%LOGFILE%, 8); 
    </Schedule> 

    # Rotate our log file every week on sunday at midnight 
    <Schedule> 
     When @weekly 
     Exec if file_exists(%LOGFILE%) file_cycle(%LOGFILE%, 8); 
    </Schedule> 
</Extension>

我已經打開端口12009與Nxlog服務器與Graylog2服務器之間的連接。然後我配置的Graylog桂的輸入： Input(GELF UDP on Port 12009) 但wehen我檢查連接，我只得到：

[[email protected] etc]$ ssh -vvv bsul0959 -p 12009 
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 
debug1: Reading configuration data /etc/ssh/ssh_config 
debug1: Applying options for * 
debug2: ssh_connect: needpriv 0 
debug1: Connecting to bsul0959 [10.41.66.84] port 12009. 
debug1: connect to address 10.41.66.84 port 12009: Connection refused 
ssh: connect to host bsul0959 port 12009: Connection refused

它說，拒絕了。所以有一種聯繫，因爲我沒有超時或類似的東西，對嗎？ Graylog服務器不接受連接。那麼，我的配置有什麼問題？ Graylog沒有收到任何東西。

預先感謝您:)

來源

2016-10-07 Emre Sahin

使用ssh檢查打開的端口有點奇怪。請注意，ssh使用TCP，並且Graylog正在偵聽UDP端口，因此您需要以不同的方式進行診斷。

來源

2016-10-09 18:14:23 b0ti

將NXLog連接到Graylog2

回答

相關問題