Hi Jan,
Lets say all offices have a VPN to the head office.
Do I just create an output on the offsite locations and set the host as the
IP of the Head office Graylog server. Then on the Head Office Graylog
server create a new input ensuring the ports match?
I have tried on the sub office setting a new Gelf Output:
connect_timeout:1000
hostname:192.168.0.211 (this is the IP of the head office server
which the sub office has access to via VPN)
port:12201
protocol:TCP
reconnect_delay:500
tcp_keep_alive:false
tcp_no_delay:false
tls_trust_cert_chain:<empty>
tls_verification_enabled:false
And on The Head Office a new Gelf Input using TCP:
recv_buffer_size: 1048576
tcp_keepalive:use_null_delimiter:
tls_client_auth_cert_file:
bind_address: 0.0.0.0
tls_cert_file:port: 12201
tls_key_file:
tls_enable:
tls_key_password:
max_message_size: 2097152
tls_client_auth: disabled
override_source:
I have left it running for a while but do not see any of the messages
showing on the Head Office - can you see what I am doing wrong?
On Tuesday, 17 May 2016 09:28:54 UTC+10, Rob wrote:
>
> We have several office locations, each office has its own Graylog server
> which is working great.
>
>
> We want to set our head office to collect all the logs/messages that are
> stored on the sub office Graylog servers.
>
>
> So in effect each sub office Graylog server will store only its own sub
> office messages but the head office will store all messages from every sub
> office.
>
>
> Can this be done by only having the Graylog servers in the sub office send
> its messages to the master in Head office? I do not want to have to
> replicate all the individual inputs on the master - just one input that
> comes from each sub office Graylog server.
>
>
> If this is possible can you please advise how I can set this up or point
> me to the doco - I have read through the Graylog docs and can only see a
> setup to have multiple Graylog servers in the same site to share the load.
>
>
> I only need the Head Office to be able to search all sub office messages -
> each individual sub office only needs access to their own messages.
>
>
> I had a look here and possibly this is something that might something I
> can use but the thread never ended with a full solution:
>
>
>
> https://groups.google.com/forum/#!searchin/graylog2/send$20graylog$20messages$20to$20another$20graylog$20server/graylog2/yZFX7XkLhTU/m6Ku_Eyq29cJ
>
>
> Thank you in advance for your replies.
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/7a767f31-c894-4a51-891a-f7e5531101c2%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
