将NXLog连接到Graylog2

我已经通过NXlog将日志成功发送到Graylog2。但是，NXlog和Graylog2都运行在同一台服务器上。现在我想通过NXlog将日志从另一台服务器发送到Graylog2，但根本没有工作。你能帮我解决吗？这是我的NXlog配置：将NXLog连接到Graylog2

User i_cdp 
Group int 

Panic Soft 

#define CERTDIR /opt/cdp/nxlog/opt/var/lib/nxlog/cert 
define CONFDIR /opt/cdp/nxlog/opt/var/lib/nxlog 
define LOGDIR /opt/cdp/nxlog/opt/var/log/nxlog 
define LOGFILE "%LOGDIR%/nxlog.log" 

SpoolDir /opt/cdp/nxlog/opt/var/spool/nxlog 

# default values: 
PidFile /opt/cdp/nxlog/opt/var/run/nxlog/nxlog.pid 
CacheDir /opt/cdp/nxlog/opt/var/spool/nxlog 
ModuleDir /opt/cdp/nxlog/opt/libexec/nxlog/modules 

<Extension _syslog> 
    Module  xm_syslog 
</Extension> 


<Extension gelf> 
    Module  xm_gelf 
</Extension> 

<Input in> 
    Module  im_file 
    File  "/opt/cdp/jboss-eap/jboss/standalone/log/*.log*" 
    Exec if $raw_event =~ /(\d\d\d\d\-\d\d-\d\d \d\d:\d\d:\d\d)/ $EventTime = parsedate($1); 
    Exec $Hostname = 'bsul0850'; 
    Exec if $raw_event =~ /ERROR/ $SyslogSeverityValue = 3; \ 
    else $SyslogSeverityValue = 6; 
    Exec $FileName = file_name(); 
    Exec if $raw_event =~ /WARN/ $Message = 'IMPORTANT!! ' + $raw_event; 
    Exec $SourceName = 'jboss'; 
</Input> 


<Output out> 
    Module om_udp 
    Host 10.41.66.84 
    Port 12009 
    OutputType GELF 
</Output> 


<Route r1> 
    Path  in => out 
</Route> 

<Extension _charconv> 
    Module  xm_charconv 
    AutodetectCharsets iso8859-2, utf-8, utf-16, utf-32 
</Extension> 

<Extension _exec> 
    Module  xm_exec 
</Extension> 

<Extension _fileop> 
    Module  xm_fileop 
    # Check the size of our log file every hour and rotate if it is larger than 5Mb 
    <Schedule> 
     Every 1 hour 
     Exec if (file_exists(%LOGFILE%) and (file_size(%LOGFILE%) >= 5M)) file_cycle(%LOGFILE%, 8); 
    </Schedule> 

    # Rotate our log file every week on sunday at midnight 
    <Schedule> 
     When @weekly 
     Exec if file_exists(%LOGFILE%) file_cycle(%LOGFILE%, 8); 
    </Schedule> 
</Extension>

我已经打开端口12009与Nxlog服务器与Graylog2服务器之间的连接。然后我配置的Graylog桂的输入： Input(GELF UDP on Port 12009) 但wehen我检查连接，我只得到：

[[email protected] etc]$ ssh -vvv bsul0959 -p 12009 
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013 
debug1: Reading configuration data /etc/ssh/ssh_config 
debug1: Applying options for * 
debug2: ssh_connect: needpriv 0 
debug1: Connecting to bsul0959 [10.41.66.84] port 12009. 
debug1: connect to address 10.41.66.84 port 12009: Connection refused 
ssh: connect to host bsul0959 port 12009: Connection refused

它说，拒绝了。所以有一种联系，因为我没有超时或类似的东西，对吗？ Graylog服务器不接受连接。那么，我的配置有什么问题？ Graylog没有收到任何东西。

预先感谢您:)

来源

2016-10-07 Emre Sahin

使用ssh检查打开的端口有点奇怪。请注意，ssh使用TCP，并且Graylog正在侦听UDP端口，因此您需要以不同的方式进行诊断。

来源

2016-10-09 18:14:23 b0ti

将NXLog连接到Graylog2

回答

相关问题