Sumologic Troubleshooting

In this blog, we will discuss how to troubleshoot the Sumologic collector from Syslog not showing to troubleshoot Script Alerts and how we can change the collector listening interface.

• First, check the status of the collector on the Sumologic UI.
  
• Second, check the connection between the devices sending the logs and the collector.
  
• Third, check the local firewall of the collector.
  
• Forth, check the collector status locally.
  
• Fifth, check if the java application is listening to the proper port.

Check Collector Status:

• First, check the collector's status on the Sumologic UI itself.
• Second, check the status of the collector on the server
  # go to the Sumologic collector directory
cd /usr/local/SumoCollector/
# check the status
./collector status
# check the status of the systemctl
sudo systemctl status collector.service
• Third, if the collector is not up and running, you might need to restart the collector and or the server or even re-install.
  PS: For a production, reach out to Sumologic support first. They have  a good support team. 

Check Collector Config and Logs:

Connectivity:

• Check if there is a firewall between the Sumologic collector and the devices sending the logs.
  
• Check reachability run ping and traceroute to and from the collector to the devices 
  
• Verify that the data-center firewall is allowing the traffic through 
  
• Check the local firewall on the server running the collector
  iptables -L -n
sudo ufw status verbose
# is you need to open the port and if you are running ufw
sudo ufw allow <udpPort>/udp
• Run tcpdump to verify that the traffic is reaching the collector
  tcpdump udp port  
• check if the collector is listening on the correct port
  sudo netstat -tulpn

• To allow script sources and/or script action sources to run, you will need to enable them by setting the Collector parameter enableScriptSource or enableActionSource in the user.properties file of the Collector.
  enableScriptSource=true
enableActionSource=true
  Note: Restart the collector to apply the configuration change.
• check if alerts are reaching the collector. The logs files should be in this directory
  /usr/local/SumoCollector/alerts/
• Check if the scripting language is available on your collector. If not, you can run a bash script that will run your script in your favourite programing language
• Check you have the correct FULL PATH of the script and the working directory
• Check Sumologic audit logs
  1. Enable Sumologic Auditing path under ( Administrator > Seciruty > Polices > Sumo Logic Auditing )
  2. Run the search query
     _index=sumologic_audit
• useful links: link, link, link