1. Describe your incident:
Hello, I am using a new 7.0.4 environment. I have noticed that all sidecar endpoints lose their respective Winlogbeat and Filebeat configurations after restarting the Graylog server. As a result, the endpoints no longer send logs. The servers and sidecars are all listed as online and accessible in the overview. After reboot i have to reconfigure all templates on the sidecar endpoint.
2. Describe your environment:
-
OS Information: 24.04.4 LTS (GNU/Linux 6.8.0-101-generic x86_64)
-
Package Version: Graylog 7.0.4+ac94792
-
Service logs, configurations, and environment variables:
There is no really helpful log for this event…
2026-03-03T10:05:52.707+01:00 INFO [IndexRetentionThread] Skipping index retention checks because the Elasticsearch cluster is unhealthy: Red, Index Registry is up: true
2026-03-03T10:05:54.307+01:00 INFO [NetworkListener] Started listener bound to [MyGraylogServer1.domain:9000]
2026-03-03T10:05:54.309+01:00 INFO [HttpServer] [HttpServer] Started.
2026-03-03T10:05:54.309+01:00 INFO [JerseyService] Started REST API at MyGraylogServer1.domain:9000
2026-03-03T10:05:54.309+01:00 INFO [ServiceManagerListener] Services are healthy
2026-03-03T10:05:54.310+01:00 INFO [ServerBootstrap] Services started, startup times in ms: {GracefulShutdownService [RUNNING]=0, UserSessionTerminationService [RUNNING]=0, BufferSynchronizerService [RUNNING]=0, LocalKafkaMessageQueueWriter [RUNNING]=0, InputSetupService [RUNNING]=0, FailureHandlingService [RUNNING]=1, NotificationSystemEventPublisher [RUNNING]=1, UrlAllowlistService [RUNNING]=2, JobSchedulerService [RUNNING]=3, EtagService [RUNNING]=3, PrometheusExporter [RUNNING]=4, LocalKafkaMessageQueueReader [RUNNING]=4, OutputSetupService [RUNNING]=5, GeoIpDbFileChangeMonitorService [RUNNING]=8, LocalKafkaJournal [RUNNING]=10, MigrationShutdownService [RUNNING]=14, MongoDBProcessingStatusRecorderService [RUNNING]=18, StreamCacheService [RUNNING]=22, ConfigureCertRenewalJobOnStartupService [RUNNING]=35, PeriodicalsService [RUNNING]=88, LookupTableService [RUNNING]=339, JerseyService [RUNNING]=2040}
2026-03-03T10:05:54.310+01:00 INFO [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2026-03-03T10:05:54.330+01:00 INFO [ServerBootstrap] Graylog server up and running.
2026-03-03T10:05:54.405+01:00 INFO [InputLauncher] Launching input [Syslog TCP/SyslogTCP/6911eb9bd9c2e6ca3f2636ca] - desired state is RUNNING
2026-03-03T10:05:54.426+01:00 INFO [InputLauncher] Launching input [Beats/TCP_WinDNS_1555/6911eb9bd9c2e6ca3f2636fe] - desired state is RUNNING
2026-03-03T10:05:54.427+01:00 INFO [InputLauncher] Launching input [Syslog UDP/Firewall_1562_Authentication/6911eb9bd9c2e6ca3f263712] - desired state is RUNNING
2026-03-03T10:05:54.428+01:00 INFO [InputLauncher] Launching input [Syslog UDP/Firewall_1560_ActivityLog/6911eb9bd9c2e6ca3f263719] - desired state is RUNNING
2026-03-03T10:05:54.432+01:00 INFO [InputStateListener] Input [Syslog TCP/SyslogTCP/6911eb9bd9c2e6ca3f2636ca] is now STARTING
2026-03-03T10:05:54.431+01:00 INFO [InputLauncher] Launching input [Syslog UDP/Firewall_1561_WebLog/6911eb9bd9c2e6ca3f263744] - desired state is RUNNING
2026-03-03T10:05:54.435+01:00 INFO [InputLauncher] Launching input [Syslog UDP/CiscoISE_1516_Authentication/6911eb9bd9c2e6ca3f26375a] - desired state is RUNNING
2026-03-03T10:05:54.435+01:00 INFO [InputStateListener] Input [Beats/TCP_WinDNS_1555/6911eb9bd9c2e6ca3f2636fe] is now STARTING
2026-03-03T10:05:54.436+01:00 INFO [InputLauncher] Launching input [Syslog UDP/SyslogVMWare/6911eb9cd9c2e6ca3f26379c] - desired state is RUNNING
2026-03-03T10:05:54.437+01:00 INFO [InputStateListener] Input [Syslog UDP/Firewall_1562_Authentication/6911eb9bd9c2e6ca3f263712] is now STARTING
2026-03-03T10:05:54.438+01:00 INFO [InputLauncher] Launching input [Syslog UDP/SyslogUDP/6911eb9cd9c2e6ca3f2637a2] - desired state is RUNNING
2026-03-03T10:05:54.443+01:00 INFO [InputStateListener] Input [Syslog UDP/Firewall_1560_ActivityLog/6911eb9bd9c2e6ca3f263719] is now STARTING
2026-03-03T10:05:54.443+01:00 INFO [InputLauncher] Launching input [Beats/Sidecar/6911eb9cd9c2e6ca3f2637ab] - desired state is RUNNING
2026-03-03T10:05:54.444+01:00 INFO [InputLauncher] Launching input [Syslog UDP/Firewall_1563_VPNAccounting/6911eb9cd9c2e6ca3f2637ba] - desired state is RUNNING
2026-03-03T10:05:54.444+01:00 INFO [AbstractTcpTransport] Enabled TLS for input [Beats/Sidecar/6911eb9cd9c2e6ca3f2637ab]. key-file=“/certificate/MyGraylogServer1_key.pem” cert-file=“/certificate/MyGraylogServer1_cert.pem”
2026-03-03T10:05:54.445+01:00 INFO [InputLauncher] Launching input [Syslog UDP/Switch_1517/69315abc34b5f5ef4b430311] - desired state is RUNNING
2026-03-03T10:05:54.448+01:00 INFO [InputStateListener] Input [Syslog UDP/CiscoISE_1516_Authentication/6911eb9bd9c2e6ca3f26375a] is now STARTING
2026-03-03T10:05:54.452+01:00 INFO [InputStateListener] Input [Syslog UDP/Firewall_1561_WebLog/6911eb9bd9c2e6ca3f263744] is now STARTING
2026-03-03T10:05:54.457+01:00 INFO [InputStateListener] Input [Syslog UDP/SyslogUDP/6911eb9cd9c2e6ca3f2637a2] is now STARTING
2026-03-03T10:05:54.460+01:00 INFO [InputStateListener] Input [Syslog UDP/SyslogVMWare/6911eb9cd9c2e6ca3f26379c] is now STARTING
2026-03-03T10:05:54.464+01:00 INFO [InputStateListener] Input [Beats/Sidecar/6911eb9cd9c2e6ca3f2637ab] is now STARTING
2026-03-03T10:05:54.466+01:00 INFO [InputStateListener] Input [Syslog UDP/Switch_1517/69315abc34b5f5ef4b430311] is now STARTING
2026-03-03T10:05:54.468+01:00 INFO [InputStateListener] Input [Syslog UDP/Firewall_1563_VPNAccounting/6911eb9cd9c2e6ca3f2637ba] is now STARTING
2026-03-03T10:05:54.485+01:00 INFO [InputStateListener] Input [Beats/TCP_WinDNS_1555/6911eb9bd9c2e6ca3f2636fe] is now RUNNING
2026-03-03T10:05:54.490+01:00 INFO [InputStateListener] Input [Syslog TCP/SyslogTCP/6911eb9bd9c2e6ca3f2636ca] is now RUNNING
2026-03-03T10:05:54.493+01:00 WARN [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input Beats2Input{title=TCP_WinDNS_1555, type=org.graylog.plugins.beats.Beats2Input, nodeId=null} (channel [id: 0xae758343, L:/[0:0:0:0:0:0:0:0]:1555]) should be >= 1048576 but is 425984.
2026-03-03T10:05:54.494+01:00 WARN [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogTCPInput{title=SyslogTCP, type=org.graylog2.inputs.syslog.tcp.SyslogTCPInput, nodeId=null} (channel [id: 0x5d97ab65, L:/[0:0:0:0:0:0:0:0]:1514]) should be >= 1048576 but is 425984.
2026-03-03T10:05:54.510+01:00 INFO [InputStateListener] Input [Syslog UDP/Firewall_1560_ActivityLog/6911eb9bd9c2e6ca3f263719] is now RUNNING
2026-03-03T10:05:54.514+01:00 INFO [InputStateListener] Input [Syslog UDP/Firewall_1563_VPNAccounting/6911eb9cd9c2e6ca3f2637ba] is now RUNNING
2026-03-03T10:05:54.520+01:00 INFO [InputStateListener] Input [Syslog UDP/SyslogUDP/6911eb9cd9c2e6ca3f2637a2] is now RUNNING
2026-03-03T10:05:54.530+01:00 INFO [InputStateListener] Input [Syslog UDP/Firewall_1561_WebLog/6911eb9bd9c2e6ca3f263744] is now RUNNING
2026-03-03T10:05:54.538+01:00 INFO [InputStateListener] Input [Syslog UDP/Firewall_1562_Authentication/6911eb9bd9c2e6ca3f263712] is now RUNNING
2026-03-03T10:05:54.545+01:00 INFO [InputStateListener] Input [Syslog UDP/Switch_1517/69315abc34b5f5ef4b430311] is now RUNNING
2026-03-03T10:05:54.550+01:00 INFO [InputStateListener] Input [Syslog UDP/SyslogVMWare/6911eb9cd9c2e6ca3f26379c] is now RUNNING
2026-03-03T10:05:54.554+01:00 INFO [InputStateListener] Input [Syslog UDP/CiscoISE_1516_Authentication/6911eb9bd9c2e6ca3f26375a] is now RUNNING
2026-03-03T10:05:54.675+01:00 WARN [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input Beats2Input{title=Sidecar, type=org.graylog.plugins.beats.Beats2Input, nodeId=null} (channel [id: 0xbff846d4, L:/[0:0:0:0:0:0:0:0]:5044]) should be >= 1048576 but is 425984.
2026-03-03T10:05:54.682+01:00 INFO [InputStateListener] Input [Beats/Sidecar/6911eb9cd9c2e6ca3f2637ab] is now RUNNING
2026-03-03T10:06:00.630+01:00 INFO [EventProcessorExecutionJob] Event processor <69283c5069db168df7924d67> is catching up on old data. Combining 12 search windows with catchUpWindowSize=3600000ms: from=2026-03-03T07:20:03.554Z to=2026-03-03T08:20:03.554Z
3. What steps have you already taken to try and solve the problem?
After reboot i have to reconfigure all winlogbeats / filebeats on the sidecar endpoints.
4. How can the community help?
Is this as bug or am i doing something wrong?