Graylog 4.3 - reinstall plugin

Graylog Central (peer support)
1

Hi everyone, I hope you are well.
I’m newbie with Graylog and I made a mistake that I’d like to fix it.
Specifically, I’ve uninstalled the Alien Vault - Open Threat Exchange (OTX) plugin / content pack and so far, I couldn’t install again.

I’ve been Googling and trying to reinstall a version that I found in Github but I wasn’t successful.

I’ll appreciate any help.

Thanks!
Diego.-

3

Hello && Welcome @dieguinsss

Can I ask what version your using? I assume this was a default content pack?

EDIT: you could try to execute the following. NOTE: ensure you make backup before reinstalling.

sudo yum reinstall  graylog-integrations-plugins

If that does not work perhaps this might work.

sudo yum reinstall  graylog-server
4

Hi gsmith,

Thank you for your response. I’m using Graylog 4.3.5 and you are right to assume that (default content pack).
I’ve already reinstalled “graylog-integrations-plugins” and “graylog-server” and it didn’t work.

5

Hello,

That is odd, did you stop Graylog service and execute a reinstall? What OS are you running?

This is my default content packs on CentOS 7, Graylog 4.3.5+32fa802

image
image741×733 48.5 KB

EDIT: Since this is a issue on a default Content pack installation, I moved this post to Graylog Central Category. In your configuration section → System/Configurations scroll down and enable it?

image
image1248×494 32.1 KB

6

@dieguinsss
I did a test on my GL server. I removed a plugin from the “Plugin” directory. It works…

image
image1920×1040 26.9 KB

EDIT: Are you referring to this?

if so here another link. Be aware this is Compatible and tested with Graylog 2.2.1, not for 4.3.5

7

hi @gsmith,
It is odd as you say. I’ve already reinstalled “graylog-integrations-plugins” and “graylog-server” directly and with Graylog service stopped.

The OS is Ubuntu 22.04.1 LTS + Graylog 4.3.5+32fa802 and there are installed the following packages related top GL:

  • graylog-4.3-repository/stable,now 1-5 all [installed]
  • graylog-enterprise-plugins/stable,now 4.3.5-1 amd64 [installed]
  • graylog-integrations-plugins/stable,now 4.3.5-1 all [installed]
  • graylog-server/stable,now 4.3.5-1 all [installed]

I’m not working with github repos, I get it that these aren’t compatible with the current version (4.3.5).

On the other hand, below I attached snapshots about my config. Even, I realized there is no listed the WHOIS content pack…

image
image2820×1568 413 KB

image
image2808×1484 354 KB

Thanks for all!
Diego.-

8

I also tried to install “graylog-enterprise-integration-plugins” but when GL service start, it response the following: :point_down: :point_down:t3:

image
image1834×242 62.6 KB

9

Hello,

Ok so something is preventing the packages from reinstall.
I dont know how your executing this but perhaps try these steps.

* root # systemctl stop graylog-server
* root # sudo apt autoclean
* root # sudo apt update
* root # sudo apt reinstall graylog-server graylog-enterprise-plugins graylog-integrations-plugins graylog-enterprise-integrations-plugins
* root # systemctl start graylog-server

When done you should see something like this.

image
image859×422 24.2 KB

If that does not work, I really don’t know, but I would look into you system logs and find out why you r unable to install packages again.

Perhaps a reboot? just an idea

10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.