Hi Dustin, On Friday, 26 August 2016 19:54:03 UTC+2, Dustin Tennill wrote: > > Now for the issue(s): > 1. We see only incoming log message from a single source when searching > the last five minutes. It is always the same source. This happens even we > KNOW there are other log data from past five minutes. If we change to the > past hour, all logs are there and appear correct. If we search past 15 > minutes, we see all log data. Sometimes we log into the second node and can > only see messages from this single source. >
What exactly do you mean with "message from a single source"? Only log messages from one of the Graylog servers or only log messages from a single client? Also, are the system clocks of all systems in sync? If not, use NTP or a similar technology to synchronize them. Cheers, Jochen -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/e347f046-85fc-4ce2-9905-e39f78545716%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
