Hi, It's quite possible that whilst I copied over the new Graylog Collector config, I may not have *entirely* commented out the sample config, which meant that the rogue (sample) server-uri value was still in there and being picked up when I ran the collector.
I only realised my mistake when I was trying to post the config to you! The collector is now showing up in the 'collectors' section of my web console and the log file isn't reporting any more errors so fingers crossed that was the problem. Thanks so much again for your help! Seán On Sunday, 15 November 2015 09:37:26 UTC, Sean McGurk wrote: > > Hi, > > I am trying to create a Graylog Server - Graylog Collector setup, where > the graylog collector collects the syslog files on one machine and ships > them to the server. > > I have used the AWS AMI to create the Graylog Server and it is working as > expected. > > I installed a Graylog Collector on the same machine and I am able to see > it in the list of sources for that instance. > > My problem is when I try and connect to a remote Graylog Collector. > > The Graylog Collector configuration file looks like this: > > server-url = "http://xxx.xxx.xxx.xxx:12900/"; > > inputs { > syslog { > type = "file" > path = "/var/log/syslog" > } > } > > outputs { > graylog-server { > type = "gelf" > host = "xxx.xxx.xxx.xxx" > port = 12201 > } > } > > where xxx.xxx.xxx.xxx is the private IP address of the graylog server I am > attempting to connect to. > > An extract from the configuration of the graylog server is: > > rest_listen_uri = http://0.0.0.0:12900/ > > And the security groups for both instances are as follows: > > Type Protocol Port Range Source > Custom TCP Rule TCP 12201 0.0.0.0/0 > Custom TCP Rule TCP 12900 0.0.0.0/0 > > When I look at the logs for the graylog collector, I get the following > messages: > > 2015-11-14T23:41:33.948+0000 ERROR [gelfTcpTransport-1-1] > gelfclient.transport.GelfTcpTransport - Connection failed: Connection > refused: /xxx.xxx.xxx.xxx:12201 > 2015-11-14T23:41:34.949+0000 ERROR [gelfTcpTransport-1-1] > gelfclient.transport.GelfTcpTransport - Connection failed: Connection > refused: /xxx.xxx.xxx.xxx:12201 > 2015-11-14T23:41:35.951+0000 ERROR [gelfTcpTransport-1-1] > gelfclient.transport.GelfTcpTransport - Connection failed: Connection > refused: /xxx.xxx.xxx.xxx:12201 > 2015-11-14T23:41:36.953+0000 ERROR [gelfTcpTransport-1-1] > gelfclient.transport.GelfTcpTransport - Connection failed: Connection > refused: /xxx.xxx.xxx.xxx:12201 > 2015-11-14T23:41:37.956+0000 ERROR [gelfTcpTransport-1-1] > gelfclient.transport.GelfTcpTransport - Connection failed: Connection > refused: /xxx.xxx.xxx.xxx:12201 > 2015-11-14T23:41:38.698+0000 WARN [HeartbeatService RUNNING] > collector.heartbeat.HeartbeatService - Unable to send heartbeat to Graylog > server: ConnectException: Connection refused > > (again xxx.xxx.xxx.xxx is the private IP address of the graylog server I > am attempting to connect to) > > I have run a traceroute between the 2 machines on port 12201 and port > 12900 without any problems. > > Can anyone tell me what I might be missing in my configuration to allow > these 2 to connect? > > Both are running Ubuntu 14.04. > > Thanks, > > Seán > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/4a616195-8c56-4084-b0a3-9f06c511a56f%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
