I'm new to Graylog and installed the community edition on our local network.
To test it, I set up a Raw/Plaintext UDP Input. On the Graylog server itself, I sent a test message:
echo -n "Test message" | nc -u -w 1 127.0.0.1 12202
This showed up in Graylog straight away. I then tried doing something similar from another machine on our network, just changing the IP address to that of the Graylog server:
echo -n "Test message" | nc -u -w 1 10.1.0.11 12202
No errors, but nothing showing up in Graylog either. On the Graylog server itself, I ran a tcpdump command to confirm that the messages were indeed arriving and not getting blocked by a firewall or other configuration issue:
16:36:01.941426 IP (tos 0x0, ttl 64, id 32949, offset 0, flags [DF], proto UDP (17), length 40)
127.0.0.1.56989 > 127.0.0.1.12202: [bad udp cksum 0xfe27 -> 0xcb1a!] UDP, length 12
16:49:39.489332 IP (tos 0x0, ttl 62, id 19424, offset 0, flags [DF], proto UDP (17), length 40)
10.1.0.4.60522 > 10.1.0.11.12202: [udp sum ok] UDP, length 12
Both messages are coming through to the server, but only the first one is showing up (the one with the bad checksum, though I believe that's a common behavior). I also tested with a GELF UDP input with the same results.
Can anyone suggest why Graylog is not picking up the second message?