What you pasted before works, it had the errors. It looks like your graylog auth configuration in Mongo isn’t valid. Is mongod running? I can’t tell if Mongo isn’t running or if graylog-server is trying to run a post-upgrade migration task that’s failing and then graylog-server stops. What’s the output of the following?
sudo systemctl status mongod sudo systemctl status graylog-server
The tail of the log is showing a duplicate key error. I think I’ve seen something similar here in another thread, trying to find it.
It looks like you’re using LDAP, is that right? You may know already but that became an enterprise-only feature in 4.x, and after the upgrade the auth configuration for LDAP is deactivated until you can review it because the way it works changes. So, it’s inconvenient but if Mongo is running you could manually remove the configuration from it to (hopefully) allow the post-upgrade migration task run by graylog-server to complete. Then, you’d need to rebuild it once everything’s running again.
@aaronsachs do you have any information on removing the graylog auth config from Mongo manually? I’m coming up empty on my search but I was sure I’d seen it somewhere.
I am. I read about it being disabled until it was updated with more config settings. I rolled back.
I can try it again and remove the ldap auth before hand from the Graylog settings.
Yeah, if you rolled back to a pre-upgrade state I think that’s a valid approach. It’s a pain especially if you have a lot of things configured but I would remove everything but the admin user to reduce the chance as much as possible. I think you should be fine even with ES already upgraded since the issue was in Mongo.
If that works I’d be curious more about your pre-upgrade auth config. If you can share it in a sanitized manner so we can review maybe we can see what’s up. I wonder if the post-upgrade migration task was failing because you had 2 different auth configs with the same group name or something, so when it tried to turn those into teams the team name (key) was already being used.
Anything you have would be appreciated by the devs I’m sure.
Seemed to have brought the system online. I never used enterprise as we do 40+ gb a day.
Shouldn’t have copied the command from the install page with those two.
Should have used this maybe?
sudo yum update && sudo yum install graylog-server graylog-integrations-plugins
Edit: I also removed the ldap/ad settings before upgrade.
Interesting. Had you removed all the LDAP related configs from Graylog before you did the upgrade? And it still failed to start until you removed enterprise plugins?
Well that’s good information. So it seems like there’s still some kind of issue post-upgrade related to Mongo but after you disabled the plugins graylog-server is bypassing the logic that manifests the error and so it’s able to start successfully. Well, I’m glad you got it working, and since you seem to be unconcerned about the loss of the enterprise features I’d say you’re good to go. At >5GB a day if you ever decided to purchase enterprise you’d have enterprise support and they would be able to help you resolve the issue at that point I’m sure.
Here’s the features comparison. You’ll need to review and assess it.
You weren’t able to use the enterprise features on the free license with a 40 GB/day volume anyways, so these features wouldn’t have been active even with a valid free enterprise (<=5GB/day) license.
