Back to listing

NetFlow

Plugin 0.1.1

[DEPRECATED] Graylog NetFlow plugin

bernd
free!

Published

15 Sep 09:25

Last Push

28 May 08:16

Marketplace Rating

Discussion

12 Comments

Your Rating

Please sign in to rate this add-on.

Comments

jezzadb over 1 year ago

Hi, it turned out to be a bug with my firewall management software. Once I fixed this up all worked well. Thanks

jezzadb over 1 year ago

Hi, I am currently running version 2.3.1 and my Cisco ASA netflow records are not being seen in Graylog. I have tried to do the updates but as of yet had no joy. Is this arrangement supposed to work

digger-squared almost 2 years ago

This plugin is not working. I can see that data is being received under inputs and "Network IO". But the messages cannot be seen. I uninstalled this Jar version 0.1.1 and then installed version 0.1.2. from https://github.com/graylog-labs/graylog-plugin-netflow/pull/6 and it works fine now.

ropeguru almost 2 years ago

So I have the plugin installed and netflow version 5 data coming from a Juniper SRX. But it doesn't appear to bee converting the data. My log entries look like this: srx RT_FLOW: RT_FLOW_SESSION_DENY: session denied 10.10.10.1/1028->192.168.1.142/30000 0x0 None 17(0) default-logdrop(global) vpn1 trust UNKNOWN UNKNOWN N/A(N/A) st0.0 UNKNOWN policy deny

And none of the nf_ fields are populated.

bubba198 over 2 years ago

I was able to successfully add the plug-in and it works like a charm. I was also able to duplicate the cool looking dashboard. However I can not find a way to visualize true flow meaning to display the source-to-destination pairs in a meaningful way. How does one do that? How doe sone see each flow pair including IPs and ports? Thank you

yfine over 2 years ago

Hi experts . i have successfully send NEtflow5 data , and i see it in the graylog search , i dont understand how do i "convert" the data that i see in the search screen to netflow dashboard like i see in the net-flow plugin info
thank you

mohitmehral over 2 years ago

1. Plugin setup has been done. 2.NetFlow UDP input defined 3. Log Messages not captured ?
Would require to place jar in client machine also?

fjjaime over 2 years ago

Sorry.... It has been permissions problem... using the right user to download and copy the plugin all works perfectly.

fjjaime over 2 years ago

Hi, I followed the installation guide (copy .jar into plugin directory) but, after restart the service (even reloading the server itself) the Netflow UDP input is missing.... What am I doing wrong?

Many Thanks....

chuckbrantley over 2 years ago

I figured it out....seems to work fine now.

chuckbrantley over 2 years ago

I can get the flows to register, but can you share how you made the dashboard and widgets? Still new to Graylog so trying to learn.

andrewm659 almost 3 years ago

So this doesn't work. I feel like there are more packages missing that I need in order to make netflow work w/ graylog. I installed any netflow packages that were in the CentOS 7 base and epel repo. Still nothing. I did an installation of nTop-ng and that worked just fine. Are there any other packages that need to be installed?

Please sign in to comment.

Back to listing