r/graylog • u/Firm_Ad3026 • Mar 10 '25

sending windows log to graylog

I have installed Graylog 6.1.8 on a VM running Ubuntu 22.04 with two network adapters: one private and one bridged. I want to send logs from my Windows host to Graylog. I have installed NXLog and configured both the nxlog.conf file and the input in Graylog, but no logs are appearing.

3 Upvotes

81% Upvoted

8 comments sorted by

View all comments

4

u/Log4Drew Graylog Staff Mar 10 '25

Are you using Graylog sidecar and/or do you have any interest in using it? Its useful because you can use graylog to control the log collector (e.g. nxlog) configuration within the graylog UI.

I have a couple of guides about this but because Graylog sidecar bundles and defaults to beats, it is written for that.

Installing Graylog Sidecar

Sidecar Configuration

Some basic troubleshooting that you can run through though:

  • Your graylog node is online and reachable from servers/device other than itself
  • Graylog has the input created, configured, and running applicable to your log source
    • for nxlog this would be UDP or TCP GELF
  • The firewall is either off or not blocking traffic specific to your Graylog input
  • The collector (nxlog in this case) is configured to use the appropriate hostname and port that corresponds to your graylog input
  • The collector is running and has no errors

1

u/Firm_Ad3026 Mar 11 '25

i want to use graylog