CSV lookup table delete fails

Graylog Central (peer support)
1

hi,

I created a CSV lookup table, with Graylog 2.3.1. I accidentally misspelled the file name. This resulted in error in UI (the triangle), due to missing file. I edited the correct filename in the UI, and the error vanished from the UI. But the java exceptions keep occurring in the log file. So I decided to delete the whole lookup data adapter. The adapter vanished from the UI, but - the java exceptions keep occurring on the log file.

I have a setup of 5 Graylog nodes, and don’t see any problems with their connectivity with each other.

2017-09-25T15:28:18.778+03:00 ERROR [CSVFileDataAdapter] Couldn't check data adapter <malware-patrol-domain> CSV file /graylog/threatintel/feed_mwp_domain.csv for updates: java.nio.file.NoSuchFileException /graylog/threatintel/feed_mwp_domain.csv
2017-09-25T15:28:45.743+03:00 ERROR [LookupDataAdapter] Couldn't refresh data adapter <malware-domain/59c0f8fd91ad3a0432d9fd30/@5236f163>
java.lang.NullPointerException: null
        at org.graylog2.lookup.adapters.CSVFileDataAdapter.doRefresh(CSVFileDataAdapter.java:102) ~[graylog.jar:?]
        at org.graylog2.plugin.lookup.LookupDataAdapter.refresh(LookupDataAdapter.java:89) ~[graylog.jar:?]
        at org.graylog2.lookup.LookupDataAdapterRefreshService.lambda$schedule$0(LookupDataAdapterRefreshService.java:142) ~[graylog.jar:?]
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_141]
        at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_141]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_141]
        at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_141]
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_141]
        at java.lang.Thread.run(Thread.java:748) [?:1.8.0_141]

Any idea on how to remove this stuff from mongodb? Or other hints?

2

Had the same issue, a quick dirty workaround - restart of the server. I just did that during the patching window. It does not impact the performance, just an annoying message.

3

could you please create an github issue for that.

thank you

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.