Syslog data don't show up to kibana

[aquinator987]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

350

Storage for /nsm

200

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

So I installaed Security Onion on-prem standalone in my organisation. I follow all the steps for configure syslog but when I go to Kibana nothing about ip address of my devices shows up. Can you help me with that ?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[reyesj2]

are you getting any syslog data? If you go to SOC -> Dashboards then hit the drop down and find the 'Syslog' dashboard do you see any events there?

Have you tried running a tcpdump on your standalone to see if it is actually receiving any syslog data? Something like the below will help you identify if the host is getting any syslog data. Replace 'ens18' with your management interface name

sudo tcpdump -nni ens18 port 9001