Page 1 of 1
Log Server doens't receive log
Posted: Fri Sep 18, 2015 3:08 pm
by dotrong
Hello,
I currently install Nagios Log Server and server doesn't seem to receive syslog/trap even though trap and syslog are forwarded to it.
The server is listening on port of syslog and trap but dashboard showing nothing.
Have anyone same issue?
Thanks,
Re: Log Server doens't receive log
Posted: Mon Sep 21, 2015 10:18 am
by jolson
What kind of logs are you forwarding to Nagios Log Server, and on what port? Please verify that logs are reaching Nagios Log Server by running a tcpdump on the appropriate port:
Code: Select all
yum install tcpdump
tcpdump -n dst port <portnumber>
Re: Log Server doens't receive log
Posted: Mon Sep 21, 2015 11:17 am
by dotrong
It's network devices syslog. We forward syslog message from a current centralized log server (syslog-ng) to Nagios Log server port 5544.
I'm testing by issuing logger command on another nagios server
logger -p local7.notice 'this is test'
tcpdump output on Nagios log server
tcpdump -i eth0 port 5544
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:09:19.378696 IP nagios1.57299 > Nagioslogserver.5544: Flags [P.], seq 2623934827:2623934883, ack 4124363618, win 115, options [nop,nop,TS val 950105481 ecr 3335455929], length 56
12:09:19.378824 IP Nagioslogserver.5544 > nagios1.57299: Flags [.], ack 56, win 501, options [nop,nop,TS val 3335480321 ecr 950105481], length 0
12:09:20.302025 IP nagios1.57299 > Nagioslogserver.5544: Flags [P.], seq 56:112, ack 1, win 115, options [nop,nop,TS val 950106404 ecr 3335480321], length 56
12:09:20.302115 IP Nagioslogserver.5544 > nagios1.57299: Flags [.], ack 112, win 501, options [nop,nop,TS val 3335481244 ecr 950106404], length 0
^C
4 packets captured
5 packets received by filter
0 packets dropped by kernel
Re: Log Server doens't receive log
Posted: Mon Sep 21, 2015 12:42 pm
by jolson
Interesting. What happens if you try to send a couple of strings to a non-5544 port?
Code: Select all
printf 'Hello world, this is a test' | nc 192.168.x.x 2056
Replace 192.168.x.x with the IP of your Nagios Log Server device.
Re: Log Server doens't receive log
Posted: Wed Sep 23, 2015 5:10 pm
by dotrong
It's really weird. I deleted all nagioslog server directory and re-installed. It's working this time !
Not sure what caused the issue the first time ... but thanks for your support.
Re: Log Server doens't receive log
Posted: Thu Sep 24, 2015 9:08 am
by hsmith
Glad to hear it is working, is there anything else we can do for you?