Log collection just stops after a period of time

[elpakko]

I'm not using 514 at all, so it could be disabled. Not sure why it's enabled in the first place. Any instructions on how to disable it without braking anything else?

I can see logs from 127.0.0.1 (localhost) in the host list, if that is what you mean.

[jsimon]

Actually looking at your system profile it looks like you have a logstash input configured to listen on port 514. You can change this by logging into your NLS as admin, going to "Configure", clicking on Global Config, and then expanding the blocks under the "Inputs" column till you find one with this in it:

Code: Select all

syslog {
        type => 'syslog'
        port => 514
    }

Change this port to one above 1024. If you do change this port, make sure you also change whatever server is sending on that port to send on the new port you configure your NLS to listen on here. You can also solve this by following the steps in the doc I linked in my previous post in this thread.

[elpakko]

Ok, it seems that some of my old switches are indeed using the port 514. I changed the user to "root" and those switches are now logging again. I'll keep monitoring over the weekend and let you know how it goes.

[jsimon]

Great! Let us know how it goes

[elpakko]

It seems that my log server survived the weekend. So your instructions fixed the problem, thanks!

[jmichaelson]

Glad to hear your problem is resolved!