Nagios Support Forum

Hi

In NLS;

1. I have enabled port 514 - UDP/TCP as the input filter. Enabled Listening On Privileged Ports too.

tcp {
type => 'syslog'
port => 514
}
------------------------------
udp {
type => 'syslog'
port => 514
}


2. In firewalld, also enabled these two ports to access incoming udp/tcp packets.
3. Activated the input filter, and there are no errors in logstash.log

But Nagios doesn't receive the logs.

When I take a tcpdump, I can see Nagios server receives the logs. But Nagiosls not.

Just to debug the issue, I followed this article to see if I have done anything wrong. https://support.nagios.com/kb/article.php?id=38

But still no luck.

Can you help me to understand what I have missed?

Thank you
Luke.

Hi Luke,

First, just to be certain, can you double check that there isn't a configuration change waiting to be applied?

I also want to verify that the input filter you posted is either two input filters, or does not actually contain the dashes. I've tried it out on a system here, and the dashes do throw a configuration error. That would prevent the new config from actually applying.

Could we also see the rsyslog configuration from the server that is sending the data? It will be in /etc/rsyslog.d/, named either 99-nagioslogserver.conf, or something similar if this is an additional file that's being monitored on that server.

Hi

Thank you for your support. As you suggested I double checked all the configuration that I have made. I have done a silly mistake when configuring the syslog config file using setup-linux.sh. I have given a wrong ip as the NLS IP.

The problem has been fixed and now I can see the logs in the dashboard.

Thank you once again.

Regards
Luke.

lukedevon wrote:Hi

Thank you for your support. As you suggested I double checked all the configuration that I have made. I have done a silly mistake when configuring the syslog config file using setup-linux.sh. I have given a wrong ip as the NLS IP.

The problem has been fixed and now I can see the logs in the dashboard.

Thank you once again.

Regards
Luke.

Great!

Locking thread