1. Describe your incident:
I’m very new to Graylog, so I apologize for the possibly basic question. We would like to include Graylog in our Citrix Master/Golden image, but I’m unsure of the best practice around making sure each VDA gets a new node-id, and not one that is cloned when we deploy the image out to multiple VDAs. In for first experiment, I provisioned 2 VDAs, and they both had the same node-id. Is it that we need to delete the node-id file before we seal the image for deployment? Thanks for your help!
2. Describe your environment:
Do you mean the graylog sidecar agent on a windows machine?
Okay, so ya just delete that file and a new one will be created the next time the service starts, and you should be good to go.
Great, thank you! When I set it up, I think I followed a non-Graylog guide; if you are collecting logs from the filesystem via filebeat (in particular, ones under a user’s profile on Windows), do you need the sidecar to be installed and NXLog, or just one or the other?
Filebeat and winlogbeat are bundled with thr windows installer of sidecar, everything else you need to manually add.
Great, thanks for the help.
Bubbling this backup if that’s OK. This works, however, every time the VDA boots, it gets a new node-id. However, in the collectors administration area, there are multiple machines with the same name now (but with separate node-ids):
Is there a recommended way to handle this?
There is a setting for how often offline sidecars a purged, i think it defaults to 5 days. You could lower that, which would help a little. Aside from that you would need to do some advanced logic on the machines for when to delete the node id file and when not to.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.