Hello to everyone …http://docs.graylog.org/en/latest/pages/collector_sidecar.html
i think i don’t need to install filebeat because it’s installed with collector-sidecar_xxxx.deb ??? is it right ? because i can’t find filebeat installed ?
i can’t find “graylog-collector-sedecar”
any help please
and this is my conf file :
> server_url: http://192.168.111.132:9000/api/
> update_interval: 30
> tls_skip_verify: true
> send_status: true
> list_log_files:
> - /var/log
> node_id: graylog-collector-sidecar
> collector_id: file:/etc/graylog/collector-sidecar/collector-id
> cache_path: /var/cache/graylog/collector-sidecar
> log_path: /var/log/graylog/collector-sidecar
> log_rotation_time: 86400
> log_max_age: 604800
> tags:
> - linux
> - apache
> backends:
> - name: nxlog
> enabled: false
> binary_path: /usr/bin/nxlog
> configuration_path: /etc/graylog/collector-sidecar/generated/nxlog.conf
> - name: filebeat
> enabled: true
> binary_path: /usr/bin/filebeat
> configuration_path: /etc/graylog/collector-sidecar/generated/filebeat.yml
jan
March 27, 2018, 6:12am
2
Filebeat is installed with the collector-sidecar - for your reference:
# dpkg-deb -c collector-sidecar_0.1.4-1_amd64.deb
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./var/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./var/spool/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./var/spool/collector-sidecar/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./var/spool/collector-sidecar/nxlog/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./var/run/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./var/run/graylog/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./var/run/graylog/collector-sidecar/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./var/log/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./var/log/graylog/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./var/log/graylog/collector-sidecar/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./usr/
drwxr-xr-x 0/0 0 2017-07-31 15:16 ./usr/share/
drwxr-xr-x 0/0 0 2017-07-31 15:16 ./usr/share/doc/
drwxr-xr-x 0/0 0 2017-07-31 15:16 ./usr/share/doc/collector-sidecar/
-rw-r--r-- 0/0 154 2017-07-31 15:16 ./usr/share/doc/collector-sidecar/changelog.gz
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./usr/bin/
-rwxrwxr-x 0/0 6161120 2017-07-31 15:16 ./usr/bin/graylog-collector-sidecar
-rwxr-xr-x 0/0 15953319 2017-07-31 15:16 ./usr/bin/filebeat
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./etc/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./etc/graylog/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./etc/graylog/collector-sidecar/
drwxrwxr-x 0/0 0 2017-07-31 15:16 ./etc/graylog/collector-sidecar/generated/
-rw-rw-r-- 0/0 703 2017-07-31 15:16 ./etc/graylog/collector-sidecar/collector_sidecar.yml
What step did you refer to when you say
i can’t find “graylog-collector-sedecar”
I can’t follow.
Please elaborate some more on what guide you follow and where you have trouble to follow the guide.
thank you
i am following the documentation ,
2 i installed collector-sidecar_0.1.5-1_amd64.deb and belive me i coudn’t find
well maybe using another version may help can you just how tu uninstall all the collector to reinstall a new one please ?
jan
March 27, 2018, 10:15am
4
So I guess you have followed the following:
http://docs.graylog.org/en/2.4/pages/collector_sidecar.html#ubuntu
What part of the commands isn’t working for you? I see in the description no ./graylog-collector-sidecar that is why I ask what part did you follow.
yes sir i’m using this part ( ubuntu 16.04 now i give up with 14.04 because i coudn’t uninstall it correctly and now i m trying with this 16.04 i m just in training session so i ve 0 experience please don’t judge me ! )
and the configuration :
server_url: http://192.168.111.132:9000/api/
but the result is
please can you help more
jan
March 27, 2018, 11:59am
6
you do not have any tag configured (in the screenshot) and that is the reason why no configuration file is written.
Check the 7th Picture in the step-by-step guide
http://docs.graylog.org/en/2.4/pages/collector_sidecar.html#step-by-step-guide
1 Like
yes you right sir !
collector_sidecar_cache_time = 2h
jan
March 27, 2018, 1:50pm
8
is your Graylog available at http://192.168.111.132:9000/api/ ? The screenhot of your Graylog did not show that.
the server_url in the collector need to be the rest_listen_uri of your Graylog server. Did you see the collector on the above visible page ( system / collectors ) when you hit the overview button?
Why did you think you need to place the both settings somewhere?
http://graylog.ddns.net == refer to 192.168.111.132http://graylog.ddns.net/api or 192.168.111.132/apihttp://graylog.ddns.net or 192.168.111.132/
it’s normal ?
no i don’t
and here i am confused 192.168.111.134 is the ip of the fist machine that i give up
jan
March 27, 2018, 2:08pm
12
when your collector did not show up on the collectos overview - inactive means it does not run and that is saved for historical reasons - do you check if the collector sidecar is actually started?
yes you right i don’t now why the collector stops working her is the erreur that i found in the log file of the collecteur
i don’t know from why he go for 127.0.0.1:9000/api
So sorry this probléme will make you creazy
good morning i’m facing a lot of issues of the ‘collector sidecar’
my config file :
ub1632@ubuntu:~$ cat /etc/graylog/collector-sidecar/collector_sidecar.ymlhttp://192.168.111.132:9000/api/
the result of
ub1632@ubuntu:~$ systemctl status collector-sidecarhttp://127.0.0.1:9000/api/plugins/org.graylog.plugins.collector/collectors/68627057-36d5-479a-b32e-f3bc68cc6781: dial tcp 127.0.0.1:9000: getsockopt: connection refused”http://127.0.0.1:9000/api/plugins/org.graylog.plugins.collector/68627057-36d5-479a-b32e-f3bc68cc6781?tags=[“linux”%2C"apache"]: dial tcp 127.0.0.1:9000: getsockopt: connection refused”http://127.0.0.1:9000/api/plugins/org.graylog.plugins.collector/collectors/68627057-36d5-479a-b32e-f3bc68cc6781: dial tcp 127.0.0.1:9000: getsockopt: connection refused”
thank you for your help !
any idea please ? i m still strugling with this probléme
marius
March 29, 2018, 8:34am
16
Hey Amine,server_url to http://192.168.111.132:9000/api/ but in the logs you can see that it tries to use the default value: http://127.0.0.1:9000/api
The Sidecar gets the path to configuration file vie the -c parameter, could check in the process list how the Sidecar was started?
Cheers,
1 Like
thank you very much ya you give me a very good hint i ll check right now thank you again Marius
still it’s not working
any idea ?
jochen
March 29, 2018, 9:20am
19
What’s the complete output of the following commands?
# sudo stat /etc/graylog/collector-sidecar/collector_sidecar.yml
# sudo namei -l /etc/graylog/collector-sidecar/collector_sidecar.yml
# sudo cat /etc/systemd/system/collector-sidecar.service
thank you for your replie !
ub1632@ubuntu:~$ sudo stat /etc/graylog/collector-sidecar/collector_sidecar.yml
AND
ub1632@ubuntu:~$ sudo namei -l /etc/graylog/collector-sidecar/collector_sidecar.yml
AND
ub1632@ubuntu:~$ sudo cat /etc/systemd/system/collector-sidecar.service
[Service]
Restart=always
[Install]
:
!
cauz now i m just learning