Hey Sean,
did you create a GELF TCP (not UDP!) Input on your graylog server on port 12201?
Kr,
D.
--
Tel.: +49 (0)40 609 452 077
Fax.: +49 (0)40 609 452 078
TORCH GmbH - A Graylog company
Steckelhörn 11
20457 Hamburg
Germany
Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175
Geschäftsführer: Lennart Koopmann (CEO)
> On 15.11.2015, at 10:37, Sean McGurk <[email protected]> wrote:
>
> Hi,
>
> I am trying to create a Graylog Server - Graylog Collector setup, where the
> graylog collector collects the syslog files on one machine and ships them to
> the server.
>
> I have used the AWS AMI to create the Graylog Server and it is working as
> expected.
>
> I installed a Graylog Collector on the same machine and I am able to see it
> in the list of sources for that instance.
>
> My problem is when I try and connect to a remote Graylog Collector.
>
> The Graylog Collector configuration file looks like this:
>
> server-url = "http://xxx.xxx.xxx.xxx:12900/";
>
> inputs {
> syslog {
> type = "file"
> path = "/var/log/syslog"
> }
> }
>
> outputs {
> graylog-server {
> type = "gelf"
> host = "xxx.xxx.xxx.xxx"
> port = 12201
> }
> }
>
> where xxx.xxx.xxx.xxx is the private IP address of the graylog server I am
> attempting to connect to.
>
> An extract from the configuration of the graylog server is:
>
> rest_listen_uri = http://0.0.0.0:12900/
>
> And the security groups for both instances are as follows:
>
> Type Protocol Port Range Source
> Custom TCP Rule TCP 12201 0.0.0.0/0
> Custom TCP Rule TCP 12900 0.0.0.0/0
>
> When I look at the logs for the graylog collector, I get the following
> messages:
>
> 2015-11-14T23:41:33.948+0000 ERROR [gelfTcpTransport-1-1]
> gelfclient.transport.GelfTcpTransport - Connection failed: Connection
> refused: /xxx.xxx.xxx.xxx:12201
> 2015-11-14T23:41:34.949+0000 ERROR [gelfTcpTransport-1-1]
> gelfclient.transport.GelfTcpTransport - Connection failed: Connection
> refused: /xxx.xxx.xxx.xxx:12201
> 2015-11-14T23:41:35.951+0000 ERROR [gelfTcpTransport-1-1]
> gelfclient.transport.GelfTcpTransport - Connection failed: Connection
> refused: /xxx.xxx.xxx.xxx:12201
> 2015-11-14T23:41:36.953+0000 ERROR [gelfTcpTransport-1-1]
> gelfclient.transport.GelfTcpTransport - Connection failed: Connection
> refused: /xxx.xxx.xxx.xxx:12201
> 2015-11-14T23:41:37.956+0000 ERROR [gelfTcpTransport-1-1]
> gelfclient.transport.GelfTcpTransport - Connection failed: Connection
> refused: /xxx.xxx.xxx.xxx:12201
> 2015-11-14T23:41:38.698+0000 WARN [HeartbeatService RUNNING]
> collector.heartbeat.HeartbeatService - Unable to send heartbeat to Graylog
> server: ConnectException: Connection refused
>
> (again xxx.xxx.xxx.xxx is the private IP address of the graylog server I am
> attempting to connect to)
>
> I have run a traceroute between the 2 machines on port 12201 and port 12900
> without any problems.
>
> Can anyone tell me what I might be missing in my configuration to allow these
> 2 to connect?
>
> Both are running Ubuntu 14.04.
>
> Thanks,
>
> Seán
>
>
> --
> You received this message because you are subscribed to the Google Groups
> "Graylog Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/graylog2/cda88585-9c4a-43bf-8d8f-8f04d8e3d346%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/A01FF33A-1888-4F65-8E13-150AEB9690C5%40graylog.com.
For more options, visit https://groups.google.com/d/optout.
