# Graylog 2.2 update from 2.1: Error processing message RawMessage **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [February 20, 2017, 7:35am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140 "2017-02-20T07:35:54Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ankit](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@ankit](https://community.graylog.org/u/ankit)\ **Post date:** [February 20, 2017, 7:35am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/1 "2017-02-20T07:35:54Z")
I have a graylog cluster with one master and one node. All was running fine until I updated to the latest version of graylog 2.2 from older 2.1. Since the update, I am getting the following error in the graylog logs. ```auto 2017-02-20T11:09:49.983+05:30 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=fefb57e0-f72e-11e6-a442-0050568c38ff, journalOffset=67018809, codec=syslog, payloadSize=128, timestamp=2017-02-20T05:39:49.982Z, remoteAddress=/10.1.15.80:65270} on input <58901f57b08e8d505ca0e93f>. 2017-02-20T11:09:49.995+05:30 ERROR [DecodingProcessor] Error processing message RawMessage{id=fefb57e0-f72e-11e6-a442-0050568c38ff, journalOffset=67018809, codec=syslog, payloadSize=128, timestamp=2017-02-20T05:39:49.982Z, remoteAddress=/10.1.15.80:65270} java.lang.IllegalArgumentException: Invalid format: "12162807:" is malformed at ":" at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:945) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:160) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:149) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parseDate(SyslogServerEvent.java:108) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parsePriority(SyslogServerEvent.java:136) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parse(SyslogServerEvent.java:152) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.(SyslogServerEvent.java:50) ~[graylog.jar:?] at org.graylog2.inputs.codecs.SyslogCodec.parse(SyslogCodec.java:123) ~[graylog.jar:?] at org.graylog2.inputs.codecs.SyslogCodec.decode(SyslogCodec.java:91) ~[graylog.jar:?] at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146) ~[graylog.jar:?] at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87) [graylog.jar:?] at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:79) [graylog.jar:?] at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:45) [graylog.jar:?] at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?] at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?] at java.lang.Thread.run(Thread.java:745) [?:1.8.0_121] 2017-02-20T11:09:50.128+05:30 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=ff1177f0-f72e-11e6-a442-0050568c38ff, journalOffset=67018810, codec=syslog, payloadSize=93, timestamp=2017-02-20T05:39:50.127Z, remoteAddress=/10.1.11.43:63267} on input <58901f57b08e8d505ca0e93f>. 2017-02-20T11:09:50.128+05:30 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=ff1177f1-f72e-11e6-a442-0050568c38ff, journalOffset=67018811, codec=syslog, payloadSize=92, timestamp=2017-02-20T05:39:50.127Z, remoteAddress=/10.1.11.43:63267} on input <58901f57b08e8d505ca0e93f>. 2017-02-20T11:09:50.128+05:30 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=ff1177f2-f72e-11e6-a442-0050568c38ff, journalOffset=67018812, codec=syslog, payloadSize=93, timestamp=2017-02-20T05:39:50.127Z, remoteAddress=/10.1.11.43:63267} on input <58901f57b08e8d505ca0e93f>. 2017-02-20T11:09:50.128+05:30 ERROR [DecodingProcessor] Error processing message RawMessage{id=ff1177f1-f72e-11e6-a442-0050568c38ff, journalOffset=67018811, codec=syslog, payloadSize=92, timestamp=2017-02-20T05:39:50.127Z, remoteAddress=/10.1.11.43:63267} java.lang.IllegalArgumentException: Invalid format: "404551:" is malformed at ":" at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:945) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:160) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:149) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parseDate(SyslogServerEvent.java:108) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parsePriority(SyslogServerEvent.java:136) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parse(SyslogServerEvent.java:152) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.(SyslogServerEvent.java:50) ~[graylog.jar:?] at org.graylog2.inputs.codecs.SyslogCodec.parse(SyslogCodec.java:123) ~[graylog.jar:?] at org.graylog2.inputs.codecs.SyslogCodec.decode(SyslogCodec.java:91) ~[graylog.jar:?] at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146) ~[graylog.jar:?] at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87) [graylog.jar:?] at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:79) [graylog.jar:?] at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:45) [graylog.jar:?] at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?] at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?] at java.lang.Thread.run(Thread.java:745) [?:1.8.0_121] 2017-02-20T11:09:50.128+05:30 ERROR [DecodingProcessor] Error processing message RawMessage{id=ff1177f0-f72e-11e6-a442-0050568c38ff, journalOffset=67018810, codec=syslog, payloadSize=93, timestamp=2017-02-20T05:39:50.127Z, remoteAddress=/10.1.11.43:63267} java.lang.IllegalArgumentException: Invalid format: "404550:" is malformed at ":" at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:945) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:160) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:149) ~[graylog.jar:?] ``` Such errors just keep on coming every second. Please help me fix it. Thanks Ankit ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [February 20, 2017, 8:50am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/2 "2017-02-20T08:50:51Z")
Hej @ankit please forgive me that I just edited your text a little (make the log more readable) your issue might be related to: [https://github.com/Graylog2/graylog2-server/pull/3503](https://github.com/Graylog2/graylog2-server/pull/3503) We will release a bug fix within the next days that should fix this issue. regards Jan ---
**Author:** ![ankit](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@ankit](https://community.graylog.org/u/ankit)\ **Post date:** [February 23, 2017, 11:24am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/3 "2017-02-23T11:24:44Z")
Hi Jan, I have upgraded the server to graylog-server-2.2.1-1 still the issue has not been resolved. I will be grateful if you could confirm that the bug was fixed in the above mentioned release. If yes, please guide me how to get rid of the error. Thanks and Regards Ankit Sharma ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [February 23, 2017, 11:39am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/4 "2017-02-23T11:39:24Z")
as already written - my statement was just a first guess! When I look again at your given error message that might be more a reason that your timestamp in your message is not parseable. You should check if your sendet messages are following Syslog RFC. If not, you might want to switch to a _Plain/Raw_ Input and parse all values with extractors or pipelines out of the message. regards Jan ---
**Author:** ![ankit](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@ankit](https://community.graylog.org/u/ankit)\ **Post date:** [February 24, 2017, 3:33am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/5 "2017-02-24T03:33:52Z")
Hi Jan, Plain/Raw Input is an option, but I am unable to understand how it was working before the update to 2.2. It was working fine in the version 2.1. Nothing has been changed on the source side. Only after the update was made to the version 2.2 it started throwing errors in the logs. Nothing in any of the sources have changed. Interestingly, the error is being thrown from Input Syslog UDP which in my configuration is receiving logs from Network Devices and Linux Servers. Please advise if a downgrade to the version 2.1 is possible or if there is any other solution rather than going to plain text / raw msg. Thanks and Regards Ankit ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [February 24, 2017, 1:41pm UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/6 "2017-02-24T13:41:05Z")
Hej @ankit downgrade is not possible. Without any more information on how you ingest messages, what your architecture is looking the first statement was my first and only try to be a miracle. It looks like the issue, but it might be something that I do not know. With kind regards Jan ---
**Author:** ![ankit](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@ankit](https://community.graylog.org/u/ankit)\ **Post date:** [February 27, 2017, 6:27am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/7 "2017-02-27T06:27:10Z")
Hi Jan, I have been looking deeper into the issue and after changing the input to Raw, I was able to get some idea of what the issue probably is. The logs being received after the upgrade are unable to process the Sequence Number sent by the switches. E.g. \<186\>1541801: Feb 27 06:09:00.481: %HARDWARE-2-FAN\_ERROR: Fan Failure \<186\>1541800: Feb 27 06:08:59.485: %HARDWARE-2-FAN\_ERROR: Fan Failure \<187\>148094: Feb 27 06:07:29.716: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/15, changed state to down \<189\>148093: Feb 27 06:07:28.713: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/15, changed state to down The error shown in the graylog logs is Invalid format: “148093:” is malformed at “:” This number is actually a Sequence Number which keeps on increasing by +1 The error shown in the graylog logs is Invalid format: “148094:” is malformed at “:” and so on… This did not happen in the earlier version. Could this parsing error be solved? Thanks and Regards Ankit Sharma ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [February 27, 2017, 9:03am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/8 "2017-02-27T09:03:11Z")
Hej @ankit looks like your message does not follow [rfc3164](https://tools.ietf.org/html/rfc3164) or [rfc5414](https://tools.ietf.org/html/rfc5424) and I can’t argue why this was handled by Graylog before the Update to 2.2.X Maybe @jochen can jump in. /jd ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [February 27, 2017, 9:18am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/9 "2017-02-27T09:18:45Z")
> [@ankit](#): > > ```auto > <186>1541801: Feb 27 06:09:00.481: %HARDWARE-2-FAN_ERROR: Fan Failure > > <186>1541800: Feb 27 06:08:59.485: %HARDWARE-2-FAN_ERROR: Fan Failure > > <187>148094: Feb 27 06:07:29.716: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/15, changed state to down > > <189>148093: Feb 27 06:07:28.713: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/15, changed state to down > > ``` These aren’t valid syslog messages according to RC 3164 or RFC 5424. Which syslog daemon or network appliances are generating these messages? For now, I’d recommend using a Raw/Plaintext Input and some extractors to process these messages. ---
**Author:** ![ankit](https://avatars.discourse-cdn.com/v4/letter/a/cab0a1/32.png) [@ankit](https://community.graylog.org/u/ankit)\ **Post date:** [February 27, 2017, 9:22am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/10 "2017-02-27T09:22:00Z")
Dear jochen, The messages are being generated by Cisco Layer 3 Switches and no configuration has been changed in the switches. It is only that after the upgrade was made error logs were generated. I am still looking deeper into the logs of the switches as well for possible changes. In the mean time, can you plz confirm that the update has not caused any such change. Thanks for your help till now… I will keep on updating you for the same. Thanks and Regards Ankit ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [February 27, 2017, 9:59am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/11 "2017-02-27T09:59:21Z")
> [@ankit](#): > > In the mean time, can you plz confirm that the update has not caused any such change. Parsing Syslog messages has been made stricter in Graylog 2.2.0: > > > \## Summary > > > > Graylog's SyslogCodec mishandles older RFC3164-style syslog messag…es that contain an ISO8601 timestamp. Example message that causes unwanted behavior: > > \`\<6\>2016-10-12T14:10:18Z hostname testmsg\[20\]: {"cf\_origin":"firehose","deployment":"cf","event\_type":"ValueMetric","ip":"127.0.0.1","job\_index":"0","level\_mod":"6","msg":"","name":"RequestLatency","origin":"bbs","time":"2016-10-12T14:10:18Z","unit":"nanos","value":2.6071897e+07}"\` > \## Expected Behavior > > > > > > Section 5.1 of \[RFC3164\](https://www.ietf.org/rfc/rfc3164.txt) says that implementers may wish to use an ISO8601 timestamp, so the expected behavior is that this is parsed out properly. > \## Current Behavior > > > > > > In SyslogCodec, messages of the above format match the regex on \[L64\](https://github.com/Graylog2/graylog2-server/blob/2.1.1/graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java#L64), which cause it to be parsed to RFC5424 standards. This causes a mangling of the fields, with the timestamp, application name, and process id becoming random words in the message part. > \## Possible Solution > > > > > > On line 64 of \[SyslogCodec\](https://github.com/Graylog2/graylog2-server/blob/2.1.1/graylog2-server/src/main/java/org/graylog2/inputs/codecs/SyslogCodec.java#L64), change the regex from: > \`\<\\\\d+\>\\\\d.\*\` > to: > \`\<\\\\d{1,3}\>\[1-9\]\\\\d{0,2}\\\\s.\*\` > > RFC5424 defines the syslog header to start with \`\VER\`, where PRI is a 1-3 digit number from 0-191, and VER is a 1-3 digit number from 1-999. Matching this will ensure that RFC3164 syslog messages with ISO8601 timestamps aren't interpreted as RFC5424 messages. > > This will also require a small update to syslog4j-graylog2 to prevent the timestamp from throwing a date parsing exception and getting replaced with Date(). I'll submit an issue to that project as well. > \## Steps to Reproduce (for bugs) > > > > > 1. Run Graylog 2.1.1 and set up a Syslog TCP stream > 2. Save the above message to a file, let's call it testmsg > 3. \`cat testmsg|nc grayloghost port\` > 4. Check Graylog, find mangled fields in the message. > \## Context > > > > > > This was discovered when trying to use Graylog to collect stats and other messages from Pivotal Cloud Foundry using the firehose-to-syslog nozzle provided to funnel stats into syslog messages. Due to the message content being JSON, the mangling of the message field causes the JSON extractor to fail on a large portion of messages. > \## Your Environment > > > \- Graylog Version: 2.1.1 > \- Elasticsearch Version: 2.3.3 > \- MongoDB Version: 3.2.6 > \- Operating System: RHEL 7.2 > \- Browser version: Chrome 52 ---
**Author:** ![npaystrup](https://avatars.discourse-cdn.com/v4/letter/n/46a35a/32.png) [@npaystrup](https://community.graylog.org/u/npaystrup)\ **Post date:** [March 3, 2017, 11:54pm UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/12 "2017-03-03T23:54:12Z")
I am also experiencing this issue since upgrading from 2.1 -\> 2.2. Was working fine for 9+ months. Sending in to Syslog UDP from a Sophos UTM firewall and it stopped working. After some packet captures on the Graylog server (CentOS), I confirmed that the traffic was making it to the server, and I could see the packet rate in the Graylog UI. Finally after checking graylog-server logs, I found similar errors which lead me here. 2017-03-03T16:40:54.925-07:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=d80b44c0-006a-11e7-9b43-00155d00120f, journalOffset=170252483, codec=syslog, payloadSize=375, timestamp=2017-03-03T23:40:54.924Z, remoteAddress=/10.0.0.1:43984} java.lang.IllegalArgumentException: Invalid format: “2017:03:03-16:40:54” is malformed at ":03:03-16:40:54" at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:945) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:160) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:149) ~[graylog.jar:?] I can see that RFC states the date should have - rather than : , but why did it suddenly break? Thanks, Nate ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [March 6, 2017, 9:05am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/13 "2017-03-06T09:05:26Z")
> [@npaystrup](#): > > but why did it suddenly break? See [Problems parsing RFC3164 Syslog Messages with ISO8601 timestamps · Issue #2954 · Graylog2/graylog2-server · GitHub](https://github.com/Graylog2/graylog2-server/issues/2954). ---
**Author:** ![anandharaj](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/anandharaj/32/111_2.png) [@anandharaj](https://community.graylog.org/u/anandharaj)\ **Post date:** [March 8, 2017, 2:43am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/14 "2017-03-08T02:43:30Z")
Im facing the same error after upgrade to v2.2.2 and its only affecting syslog messages from network switches (Cisco) ``` 2017-03-08T09:40:48.612+08:00 ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=41775600-03a0-11e7-93c0-06000a048809, journalOffset=534239120, codec=syslog, payloadSize=139, timestamp=2017-03-08T01:40:48.608Z, remoteAddress=/1.1.1.1:50710} on input <57454ac18e5aad4a45805694>. 2017-03-08T09:40:48.612+08:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=41775600-03a0-11e7-93c0-06000a048809, journalOffset=534239120, codec=syslog, payloadSize=139, timestamp=2017-03-08T01:40:48.608Z, remoteAddress=/1.1.1.1:50710} java.lang.IllegalArgumentException: Invalid format: "1464:" is malformed at ":" at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:945) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:160) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:149) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parseDate(SyslogServerEvent.java:108) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parsePriority(SyslogServerEvent.java:136) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parse(SyslogServerEvent.java:152) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.(SyslogServerEvent.java:50) ~[graylog.jar:?] at org.graylog2.inputs.codecs.SyslogCodec.parse(SyslogCodec.java:123) ~[graylog.jar:?] at org.graylog2.inputs.codecs.SyslogCodec.decode(SyslogCodec.java:91) ~[graylog.jar:?] at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146) ~[graylog.jar:?] at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87) [graylog.jar:?] at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:79) [graylog.jar:?] at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:45) [graylog.jar:?] at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?] at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?] at java.lang.Thread.run(Thread.java:745) [?:1.8.0_121] 2017-03-08T10:07:23.234+08:00 WARN [NodePingThread] Did not find meta info of this node. Re-registering. ``` ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [March 8, 2017, 3:09pm UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/15 "2017-03-08T15:09:01Z")
Try deactivating sequence numbers for syslog messages: [https://www.cisco.com/c/en/us/td/docs/routers/access/wireless/software/guide/SysMsgLogging.html#wp1054751](https://www.cisco.com/c/en/us/td/docs/routers/access/wireless/software/guide/SysMsgLogging.html#wp1054751) ---
**Author:** ![anandharaj](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/anandharaj/32/111_2.png) [@anandharaj](https://community.graylog.org/u/anandharaj)\ **Post date:** [March 9, 2017, 7:36am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/16 "2017-03-09T07:36:58Z")
By default, the sequence number was not activated also. When i activate, i see repeating of sequence number on the raw data With sequence number disabled: > ``` > 15:20:19.345977 IP 10.10.10.10.61465 > graylog-server.fujitsu-dtcns: UDP, length 118 > 0x0000: 0600 0a04 8809 e4a8 b66b 2b9b 0800 4500 .........k+...E. > 0x0010: 0092 000f 0000 fc11 183b 0a02 0a02 0a04 .........;...... > 0x0020: 8809 f019 05ea 007e 1dbf 3c31 3831 3e31 .......~..<181>1 > 0x0030: 3238 3134 373a 204d 6172 2020 3920 3230 28147:.Mar..9.20 > 0x0040: 3137 2031 353a 3230 3a31 352e 3334 3320 17.15:20:15.343. > 0x0050: 676d 743a 2025 5359 532d 352d 434f 4e46 gmt:.%SYS-5-CONF > > ``` With sequence number enabled: > ``` > 15:19:38.815143 IP 10.10.10.10.61465 > graylog-server.fujitsu-dtcns: UDP, length 148 > 0x0000: 0600 0a04 8809 e4a8 b66b 2b9b 0800 4500 .........k+...E. > 0x0010: 00b0 000d 0000 fc11 181f 0a02 0a02 0a04 ................ > 0x0020: 8809 f019 05ea 009c 83dc 3c31 3830 3e31 ..........<180>1 > 0x0030: 3238 3134 353a 2031 3238 3134 353a 204d 28145:.128145:.M > 0x0040: 6172 2020 3920 3230 3137 2031 353a 3139 ar..9.2017.15:19 > 0x0050: 3a33 342e 3831 3220 676d 743a 2025 4334 :34.812.gmt:.%C4 > 0x0060: 4b5f 4542 4d2d 342d 484f 5354 464c 4150 K_EBM-4-HOSTFLAP > > ``` ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [March 9, 2017, 10:14am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/17 "2017-03-09T10:14:08Z")
> [@anandharaj](#): > > When i activate, i see repeating of sequence number on the raw data Are you sending messages from your Cisco devices directly to Graylog or are you aggregating them before? The duplicated sequence number looks fishy. ---
**Author:** ![anandharaj](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/anandharaj/32/111_2.png) [@anandharaj](https://community.graylog.org/u/anandharaj)\ **Post date:** [March 13, 2017, 6:01am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/18 "2017-03-13T06:01:36Z")
Yes, the messages are directly from Cisco switches. ---
**Author:** ![joemailey1](https://avatars.discourse-cdn.com/v4/letter/j/bc79bd/32.png) [@joemailey1](https://community.graylog.org/u/joemailey1)\ **Post date:** [March 23, 2017, 10:21am UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/19 "2017-03-23T10:21:46Z")
I seem to have ran in to this same issue - I had began testing with the 2.1 OVA, by the time I came around to doing my setup. 2.2.2 was out and I can’t seen messages to syslog UDP, can send Raw fine. ``` 2017-03-22T22:28:32.546Z ERROR [DecodingProcessor] Unable to decode raw message RawMessage{id=e1a23820-0f4e-11e7-ab24-00155d007505, journalOffset=86612, codec=syslog, payloadSize=142, timestamp=2017-03-22T22:28:32.546Z, remoteAddress=/10.0.0.x:45715} on input <58d2f49a70458204bb40ef3f>. 2017-03-22T22:28:32.546Z ERROR [DecodingProcessor] Error processing message RawMessage{id=e1a23820-0f4e-11e7-ab24-00155d007505, journalOffset=86612, codec=syslog, payloadSize=142, timestamp=2017-03-22T22:28:32.546Z, remoteAddress=/10.0.0.1:45715} java.lang.IllegalArgumentException: Invalid format: "1490221712.532473937" is malformed at "2.532473937" at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:945) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:160) ~[graylog.jar:?] at org.joda.time.DateTime.parse(DateTime.java:149) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parseDate(SyslogServerEvent.java:108) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.structured.StructuredSyslogServerEvent.parseDate(StructuredSyslogServerEvent.java:113) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parsePriority(SyslogServerEvent.java:136) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parse(SyslogServerEvent.java:152) ~[graylog.jar:?] at org.graylog2.syslog4j.server.impl.event.structured.StructuredSyslogServerEvent.(StructuredSyslogServerEvent.java:50) ~[graylog.jar:?] at org.graylog2.inputs.codecs.SyslogCodec.parse(SyslogCodec.java:121) ~[graylog.jar:?] at org.graylog2.inputs.codecs.SyslogCodec.decode(SyslogCodec.java:91) ~[graylog.jar:?] at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146) ~[graylog.jar:?] at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87) [graylog.jar:?] at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:79) [graylog.jar:?] at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:45) [graylog.jar:?] at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?] at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?] at java.lang.Thread.run(Thread.java:745) [?:1.8.0_121] ``` Any fix for this yet? I’m trying to send logs from a Cisco Meraki firewall MX100. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [March 23, 2017, 3:04pm UTC](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140/20 "2017-03-23T15:04:23Z")
> [@joemailey1](#): > > Any fix for this yet? Yes, use a Raw/Plaintext UDP input instead of a Syslog UDP input and add some extractors or use the message processing pipeline to get structured information out of these messages. [Next page](https://community.graylog.org/t/graylog-2-2-update-from-2-1-error-processing-message-rawmessage/140.md?page=2)