CSV lookup table delete fails


I created a CSV lookup table, with Graylog 2.3.1. I accidentally misspelled the file name. This resulted in error in UI (the triangle), due to missing file. I edited the correct filename in the UI, and the error vanished from the UI. But the java exceptions keep occurring in the log file. So I decided to delete the whole lookup data adapter. The adapter vanished from the UI, but - the java exceptions keep occurring on the log file.

I have a setup of 5 Graylog nodes, and don’t see any problems with their connectivity with each other.

2017-09-25T15:28:18.778+03:00 ERROR [CSVFileDataAdapter] Couldn't check data adapter <malware-patrol-domain> CSV file /graylog/threatintel/feed_mwp_domain.csv for updates: java.nio.file.NoSuchFileException /graylog/threatintel/feed_mwp_domain.csv
2017-09-25T15:28:45.743+03:00 ERROR [LookupDataAdapter] Couldn't refresh data adapter <malware-domain/59c0f8fd91ad3a0432d9fd30/@5236f163>
java.lang.NullPointerException: null
        at org.graylog2.lookup.adapters.CSVFileDataAdapter.doRefresh(CSVFileDataAdapter.java:102) ~[graylog.jar:?]
        at org.graylog2.plugin.lookup.LookupDataAdapter.refresh(LookupDataAdapter.java:89) ~[graylog.jar:?]
        at org.graylog2.lookup.LookupDataAdapterRefreshService.lambda$schedule$0(LookupDataAdapterRefreshService.java:142) ~[graylog.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_141]
        at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_141]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_141]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_141]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]

Any idea on how to remove this stuff from mongodb? Or other hints?

Had the same issue, a quick dirty workaround - restart of the server. I just did that during the patching window. It does not impact the performance, just an annoying message.

could you please create an github issue for that.

thank you

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.