Skip to main content

Troubles configuring linux forwarder

  • April 3, 2023
  • 7 replies
  • 8 views

Forum|alt.badge.img+5

Hello, I'm having troubles configuring my linux forwarder. I've completed the setup as per documentation but I don't get any log on the SIEM. Any hint?

7 replies

Forum|alt.badge.img+12
  • Staff
  • April 3, 2023

Hi @Antonino_La2 first of all I would recommend to validate that there isn't a firewall or web proxy blocking the traffic.

In addition, you can check the forwarder for logs - You can use this guide https://cloud.google.com/chronicle/docs/install/forwarder-linux the command would be : docker logs cfps --follow


Forum|alt.badge.img+5
  • Author
  • New Member
  • April 3, 2023

Hi @shakedtal thank you for your reply. I've followed the guide you attached. The container looks like it's working fine. Following the logs with docker logs -f cfps I get lot of logs like these:

488 syslog.go:396] Accepting new syslog TCP connection.
488 malchite.go.257] Batch (8, NIX_SYSTEM) successfully uploaded.

Already checked firewall/proxy configuration but nothing :(


Forum|alt.badge.img+12
  • Staff
  • April 3, 2023

Have you looked to see that the forwarder itself is receiving telemetry? Between two linux machines you can use netcat to push a string on a specific port, for example


Forum|alt.badge.img+5
  • Author
  • New Member
  • April 3, 2023

I didn't check that but since this is a test the telemetry come from the same machine where the forwarder is running. I thought that the telemetry was successfully received due to the "Accepting new syslog TCP connection." line in the logs


Forum|alt.badge.img+12
  • Staff
  • April 3, 2023

If that's the case, you can go on the same machine and verify that the syslog folder has content.


Forum|alt.badge.img+5
  • Author
  • New Member
  • April 3, 2023

Checked and there are several logs inside


Forum|alt.badge.img+12
  • Staff
  • April 3, 2023

Hi @Antonino_La2 I would recommend opening a support ticket to the team to take this forward. Please let me know if you have any additional questions.