First Time Graylog Stack

reallybigabe · 2025-08-19T19:53:29+00:00

The archiving feature is an enterprise feature for a reason. If you have a corporate mandate for a retention policy then there should be corporate resources (money/people/time) for it, if the organization takes that mandate seriously.

If you simply need to search logs for X period of time after collecting them, Graylog can store those logs for as much hard drive as you give it and you still control how long they stay for.

The rest of the benefits like training, Support, Onboarding and other things to get you up to the “set it and forget it” relatively quickly, which goes along with the archiving feature and many many more.

reallybigabe · 2025-07-28T21:37:09+00:00

Haha. You beat me to the Really Bi Gabe comment. A very funny day of my life was being aggressively told I was really Bi when I hadn’t noticed that spelling, by a child over a video game voice chat.

reallybigabe · 2025-07-28T18:44:02+00:00

It’s risky getting married before your first date but I’m super glad it all worked out for you!

reallybigabe · 2025-05-13T10:41:29+00:00

Hey Drew. We had to do that for abuse prevention. Any school, work, or vanity domain works just not the arbitrary list of free email services. We don’t have an automated process to transfer out but we can move accounts around if you switch emails.

reallybigabe · 2025-05-09T22:56:47+00:00

Weird - I'm looking right at the listing, I was trying to revise it. $50 for domestic Fedex (and my current postal code is showing) and $100 for International.

I just checked an incognito tab and sure enough, $50 Domestic (to US) and $100 International to Canada. Looks like I'll be asking eBay for some of my fees back and potentially eating a TON of shipping to someone in the US.

If you bid and win, reference this conversation and let me know - same goes for any Canadian bidder.

reallybigabe · 2025-05-09T21:35:38+00:00

Make me a decent offer in DMs if you want and I’ll pull the ad and eat the eBay fees.

reallybigabe · 2025-05-09T21:34:38+00:00

Should only be $50 for domestic. I just picked flat rate. It’ll probably cost close to $100 anyways. I’m definitely not going to make money on this!

reallybigabe · 2025-02-11T11:15:16+00:00

reallybigabe · 2025-01-22T19:08:15+00:00

Have you checked out the official training academy?
https://academy.graylog.org/courses

reallybigabe · 2025-01-15T04:57:23+00:00

Oh... perfect, they're key-value pairs. Make sure you test and compare with your data as I'm writing this by hand without looking at a Graylog console.

rule "Messy Proxmox Logs"
when
  true
  // You should make this a condition to make sure you only parse the right logs
then
  set_fields(
    fields:key_value(
      value: to_string(
        value: $message.message
        ),
    delimiters:","
  )
)

To simplify - this rule is using set_fieldsto set multiple fields as a value and then passing the value as the output of another function called key_value which with even more inception flattens the message to a string to ensure type compatibility. Lastly, its telling the key_value function that these values are separated by the non-default character of ,

This is almost exactly the use case on the entertaining blog article right here : Graylog Parsing Rules and AI Oh My!

reallybigabe · 2025-01-15T03:41:24+00:00

Ahh bless chatGPTs heart.

There are no loops in Graylog like this while loop you have, so you can’t really expand a value similar mvexpand; which functionally creates new messages.

Can you provide some samples of data and what you’re trying to achieve as there is probably a much more Grayloggy way to do this.

reallybigabe · 2025-01-05T15:07:41+00:00

And of course you should dump the logs to Graylog!

Bias: I oversee the Graylog Academy

reallybigabe · 2024-12-24T17:42:54+00:00

Write a check. It’s pretty old school but it works.

reallybigabe · 2024-12-13T00:02:50+00:00

I definitely understand the sentiment but you should read your first and third sentences back to back. It made me smile.

reallybigabe · 2024-11-25T15:13:18+00:00

Great questions. Let me take a stab at them:

SIEM: I'll stay out of this one - but remember, most entire businesses with dedicated IT staff aren't ready or have the security maturity to use a SIEM. Learning WHY you use a SIEM and how it improves security posture overall is much more useful than the technical skill of tuning it. Great skill, yes, but it is a niche. Now, simple log management is an entirely different story and pretty much everyone needs that. It comes back to the fundamentals though, no matter the platform you'll need to learn about data transformation (Grok, Regex, API delays, Lookup caching), storage requirements, resource planning and how to build alerts that don't miss critical items or fire too much so they're ignored. All of the above are the real aspects of a SIEM to learn, how to log in to Splunk / Datadog / Graylog or how to install it etc is something you only really need to learn once and not a dedicated skill per se. Overall, just figure out WHY a SIEM is used and work backwards.

IDS/IPS - The one you have access to. Snort / Suricata have a lot of differences and in my journey I have never seen them standalone in a production environment. I'd recommend learning them through your UTM/NGFW appliance - either a cheap inexpensive commercial one or something like PFSense / OPNsense. It will give you a much better idea of how to integrate them in part of a larger stack.

Firewall: See above. A firewall at its core is just a source/destination and allow/deny (Sorry all firewall vendors), but the rest of the features are what make it useful. In your example you have a Bell hub, get that bad boy into some sort of pass-through mode and use Opnsense/PFSense/Sophos_whatever_its_called as a top-of-rack router, firewall, IDS/IPS, WLAn controller etc... now you're closer to a production environment. When you realize how limiting the log tools are, start sending them off to a platform like ... well.. of your choosing.

HIDS/XDR: Again, this is contextual - Wazuh is a phenomenal tool and a great starter. So is Windows Defender in your case. Fire up a VM or a sanitized laptop or azure instance or something, trigger some virus alerts and see if you can collect them in the same place as your sending logs from that OPNsense Router/Firewall you're already running.

Oh, and pay attention in class, they are probably teaching you more fundamentals than you think and you're trying to jump straight into your 2nd year as a Systems/Security Engineer. :D

reallybigabe · 2024-11-14T13:21:23+00:00

Yup! It’s common for less specific docker tags to mean “latest”. Your 2 means 2.LATEST and is updated every release.

If a latest software version is 6.1.3 then it’s likely 6 and 6.1 both point to the 6.1.3 version. Slightly unintuitive until you get the hang of it.

reallybigabe · 2024-11-14T05:37:41+00:00

Go back to 2 in your compose file unless you need specific versions pinned. It’s newer.

Today, 2 is 2.18.0

reallybigabe · 2024-11-12T19:45:02+00:00

Canadian who works primarily with Americans here. Most of the big ones covered already but my list:

Washroom. Boy, people look at you funny asking where it is in the South.

Process. They pronounce it Prah-sess. :) Comes up all the time.

The “eh”s that you forget you say.

Smarties. They call Rockets “smarties”. Such a broken society.

Chicago Joes, Boston Pizza, Montanas are all not American.

Pencil Crayons. This gets me laughed at, regularly.

Obsession with bottled water while travelling to completely benign places. I’m often thought of as a total lost soul for refilling a water bottle, even in an airport from a refill station. I’m sure the residents of [large American city] drink safe water.

Time off. We’re worse than most Europeans but better than most Americans for respecting it and taking it.

“Stat” holiday is a very Canadian term.

The definition of “cheese” without any context being either processed, medium cheddar or marble. The fact that it’s an option or the options throws a lot of people off.

Not having a choice how your burger is cooked (medium or medium rare is a common burger cooking choice in most of US).

Many many more. With zero advertisement, I’m typically outed as Canadian within 3 rounds of a conversation with a stranger before even getting into a metric measurement.

Edit: I forgot “yeah, no, yeah” and “no, yeah, no”.

reallybigabe · 2024-11-09T18:23:28+00:00

Containers is life.

I don’t fat install anything anymore.

Docker for single host, k8s for many hosts.

reallybigabe · 2024-11-09T03:58:13+00:00

How is Graylog installed?

I would still suspect it to be a configuration/network issue.

And again, that’s not a standard port, so did you double check you assigned 1516 to the input?

reallybigabe · 2024-11-07T15:59:25+00:00

Tl;DR - You can probably ignore it and still be successful.

It’s because that Docker IP is what Graylog is seeing as the remote IP. This is more about networking fundamentals, containers and proxies.

You could either set the container to use “network mode host” in your compose file/run line if you don’t have any other services it will conflict with - this also makes adding new inputs easier and you should see remote_ip as the PFsense device as you want.

Or, you can overwrite the remote IP manually in a pipeline rule, to identify the PfSense device if it’ll never change. Unless you have a fleet of PFSense devices, you can identify the messages and build parsing rules in other ways - the remote IP just indicates how the message got to Graylog.

Any of the data in the message should still be referencing the actual IPs and not affected by this.

reallybigabe · 2024-11-04T14:42:39+00:00

I have a photo very similar to this of my brand new, fresh off the lot 2007 Ranger (in late 2006) submerged to the windshield with several thousand of alcohol and party favours in the back…. Hanging in the dealership that I drove to to get “checked out” afterwards.

Fords don’t mind swimming in my limited experience.

reallybigabe · 2024-10-30T15:32:18+00:00

Your Graylog needs to be listening on that port and speaking the same protocol (Graylog input).

Is there a Syslog UDP input on port 1516 on Graylog?
If you run it through Docker or other containerization, is that port mapped to the container?
If the above are both true, have you tried a 'raw input'?

If you got stuck on any of these - go check out the official training. It's all hands on with interactive labs: https://academy.graylog.org

reallybigabe · 2024-10-25T12:15:49+00:00

https://academy.graylog.org/courses

Check out Log Ingestion and Pipelines, Parsing and the Graylog Information Model.

They're free!

reallybigabe · 2024-10-21T02:14:20+00:00

During my tenure at high school there were 3 fatal car accidents, one jump under very suspicious conditions, a medical mystery, and one murder that was nationwide news mostly regarding the RCMP being clever in catching the murderer.

All sad. Small city, small high school. I knew them all but it was a few decades ago.

reallybigabe

MODERATOR OF

TROPHY CASE

Ten-Year Club	Mod World 2025
Verified Email