Hi, On Monday, 6 February 2017 12:16:12 UTC+1, [email protected] wrote: > > I haved stopped input, the graylog should not receive all logs, BUT the > abnormal message can be received as before. >
Please verify with Wireshark or tcpdump, that these messages are indeed being received by Graylog or if they simply have a timestamp "in the future" so that they only show up now in a search query (try using an absolute search with its end some hours in the future). Cheers, Jochen -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/f90d31e2-ae47-45f2-a72c-d8bd80657b19%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
