This is essentially the same situation as reported in GitHub (https://github.com/Graylog2/graylog2-server/issues/2775#issuecomment-300510895), but I was asked to move this here.
We’ve got Windows machines, where we’d like to apply a base Windows collector configuration, as well as more specific app-based configurations (SQLServer, etc). In the cases where we’re applying multiple configurations to nodes with tags, the collector agent is going into an Unknown state.
According to the Github link above, it’s because of duplicate entries in the configuration, we’re just not sure exactly how to fix that. We also see this message in the Graylog Collector log:
time="2017-05-10T20:40:52-07:00" level=warning msg="[nxlog] Skipping snippet 5907bf752592bd14d9a2c7dd till it already exist in configuration."
We’re configuring out collector configurations via the GUI, and we have two collector configurations with separate event log queries.
I just upgraded the Collector agent to 0.1.1 yesterday, same issue.
Any idea how to resolve?
-Ray