Graylog Content Packs page will not load after upgrading from v3.0 to v3.1

Graylog Central (peer support)
1

We just upgraded our test Graylog 3.0 server to v3.1. Afterwards, I noticed the Content Packs link on web page would hang at “Loading…”

The below message appears in Graylog server.log

    2019-08-20T17:01:57.051-04:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
    java.lang.RuntimeException: IOException encountered while reading from a byte array input stream
            at org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:67) ~[graylog.jar:?]
            at com.mongodb.DBDecoderAdapter.decode(DBDecoderAdapter.java:49) ~[graylog.jar:?]
            at com.mongodb.DBDecoderAdapter.decode(DBDecoderAdapter.java:29) ~[graylog.jar:?]
            at com.mongodb.operation.CommandResultArrayCodec.decode(CommandResultArrayCodec.java:52) ~[graylog.jar:?]
            at com.mongodb.operation.CommandResultDocumentCodec.readValue(CommandResultDocumentCodec.java:60) ~[graylog.jar:?]
            at org.bson.codecs.BsonDocumentCodec.decode(BsonDocumentCodec.java:84) ~[graylog.jar:?]
            at org.bson.codecs.BsonDocumentCodec.decode(BsonDocumentCodec.java:41) ~[graylog.jar:?]
            at org.bson.codecs.configuration.LazyCodec.decode(LazyCodec.java:47) ~[graylog.jar:?]
            at org.bson.codecs.BsonDocumentCodec.readValue(BsonDocumentCodec.java:101) ~[graylog.jar:?]
            at com.mongodb.operation.CommandResultDocumentCodec.readValue(CommandResultDocumentCodec.java:63) ~[graylog.jar:?]
            at org.bson.codecs.BsonDocumentCodec.decode(BsonDocumentCodec.java:84) ~[graylog.jar:?]
            at org.bson.codecs.BsonDocumentCodec.decode(BsonDocumentCodec.java:41) ~[graylog.jar:?]
            at com.mongodb.connection.ReplyMessage.<init>(ReplyMessage.java:51) ~[graylog.jar:?]
            at com.mongodb.connection.InternalStreamConnection.receiveCommandMessageResponse(InternalStreamConnection.java:301) ~[graylog.jar:?]
            at com.mongodb.connection.InternalStreamConnection.sendAndReceive(InternalStreamConnection.java:255) ~[graylog.jar:?]
            at com.mongodb.connection.UsageTrackingInternalConnection.sendAndReceive(UsageTrackingInternalConnection.java:98) ~[graylog.jar:?]
            at com.mongodb.connection.DefaultConnectionPool$PooledConnection.sendAndReceive(DefaultConnectionPool.java:441) ~[graylog.jar:?]
            at com.mongodb.connection.CommandProtocolImpl.execute(CommandProtocolImpl.java:80) ~[graylog.jar:?]
            at com.mongodb.connection.DefaultServer$DefaultServerProtocolExecutor.execute(DefaultServer.java:189) ~[graylog.jar:?]
            at com.mongodb.connection.DefaultServerConnection.executeProtocol(DefaultServerConnection.java:264) ~[graylog.jar:?]
            at com.mongodb.connection.DefaultServerConnection.command(DefaultServerConnection.java:126) ~[graylog.jar:?]
            at com.mongodb.connection.DefaultServerConnection.command(DefaultServerConnection.java:118) ~[graylog.jar:?]
            at com.mongodb.operation.CommandOperationHelper.executeWrappedCommandProtocol(CommandOperationHelper.java:226) ~[graylog.jar:?]
            at com.mongodb.operation.CommandOperationHelper.executeWrappedCommandProtocol(CommandOperationHelper.java:217) ~[graylog.jar:?]
            at com.mongodb.operation.CommandOperationHelper.executeWrappedCommandProtocol(CommandOperationHelper.java:120) ~[graylog.jar:?]
            at com.mongodb.operation.FindOperation$1.call(FindOperation.java:717) ~[graylog.jar:?]
            at com.mongodb.operation.FindOperation$1.call(FindOperation.java:711) ~[graylog.jar:?]
            at com.mongodb.operation.OperationHelper.withConnectionSource(OperationHelper.java:471) ~[graylog.jar:?]
            at com.mongodb.operation.OperationHelper.withConnection(OperationHelper.java:415) ~[graylog.jar:?]
            at com.mongodb.operation.FindOperation.execute(FindOperation.java:711) ~[graylog.jar:?]
            at com.mongodb.operation.FindOperation.execute(FindOperation.java:83) ~[graylog.jar:?]
            at com.mongodb.Mongo$3.execute(Mongo.java:826) ~[graylog.jar:?]
            at com.mongodb.Mongo$3.execute(Mongo.java:813) ~[graylog.jar:?]
            at com.mongodb.DBCursor.initializeCursor(DBCursor.java:877) ~[graylog.jar:?]
            at com.mongodb.DBCursor.hasNext(DBCursor.java:144) ~[graylog.jar:?]
            at org.mongojack.DBCursor.hasNext(DBCursor.java:330) ~[graylog.jar:?]
            at com.google.common.collect.ImmutableSet.copyOf(ImmutableSet.java:241) ~[graylog.jar:?]
            at com.google.common.collect.ImmutableSet.copyOf(ImmutableSet.java:230) ~[graylog.jar:?]
            at org.graylog2.contentpacks.ContentPackPersistenceService.loadAll(ContentPackPersistenceService.java:71) ~[graylog.jar:?]
            at org.graylog2.contentpacks.ContentPackPersistenceService.loadAllLatest(ContentPackPersistenceService.java:75) ~[graylog.jar:?]
            at org.graylog2.rest.resources.system.contentpacks.ContentPackResource.listLatestContentPacks(ContentPackResource.java:123) ~[graylog.jar:?]
            at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_191]
            at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_191]
            at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_191]
            at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_191]
            at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) ~[graylog.jar:?]
            at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) ~[graylog.jar:?]
            at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) ~[graylog.jar:?]
            at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:205) ~[graylog.jar:?]
            at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) ~[graylog.jar:?]
            at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) ~[graylog.jar:?]
            at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) ~[graylog.jar:?]
            at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) ~[graylog.jar:?]
            at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]
            at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]
            at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]
            at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]
            at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]
            at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]
            at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]
            at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]
            at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]
            at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]
            at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]
            at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:181) [graylog.jar:?]
            at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_191]
            at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_191]
            at java.lang.Thread.run(Thread.java:748) [?:1.8.0_191]
    Caused by: com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "requires" (class org.graylog2.contentpacks.model.AutoValue_ContentPackV1$Builder), not marked as ignorable (13 known properties: "entities", "rev", "summary", "vendor", "created_at", "name", "url", "v", "_id", "id", "description", "parameters", "server_version"])
     at [Source: de.undercouch.bson4jackson.io.LittleEndianInputStream@74df9faa; pos: 610] (through reference chain: org.graylog2.contentpacks.model.AutoValue_ContentPackV1$Builder["requires"])
            at com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:63) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.DeserializationContext.handleUnknownProperty(DeserializationContext.java:834) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:1093) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownProperty(BeanDeserializerBase.java:1489) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownVanilla(BeanDeserializerBase.java:1467) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.deser.BuilderBasedDeserializer.deserializeFromObject(BuilderBasedDeserializer.java:317) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.deser.BuilderBasedDeserializer.deserialize(BuilderBasedDeserializer.java:178) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.jsontype.impl.AsPropertyTypeDeserializer._deserializeTypedForId(AsPropertyTypeDeserializer.java:129) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.jsontype.impl.AsPropertyTypeDeserializer.deserializeTypedFromObject(AsPropertyTypeDeserializer.java:97) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.deser.AbstractDeserializer.deserializeWithType(AbstractDeserializer.java:209) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.deser.impl.TypeWrappedDeserializer.deserialize(TypeWrappedDeserializer.java:63) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:3786) ~[graylog.jar:?]
            at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2181) ~[graylog.jar:?]
            at org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:80) ~[graylog.jar:?]
            at org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:64) ~[graylog.jar:?]
            ... 67 more

Via Mongo query db.content_packs.find(); I am able to print out the Content packs with these names.

Core Grok Patterns
Tor Exit Node List - Threat Intel Plugin
abuse.ch Ransomware - Threat Intel Plugin
Spamhaus DROP - Threat Intel Plugin
Whois - Threat Intel Plugin
Default Grok Patterns

Have tried removing them, and that clears the error, but not sure how to get the Content Packs back then. I restored a dump made before removing, and now have the “Loading…” issue again. Not sure how I’d go about editing them in Mongo. Need help or advice.

2

Hi @JHilke,

the backtrace looks like as you have a content pack from the 3.0 development beta version.

You can find it with querying the mongodb with: db.content_packs.find({ "requires" : { "$exists" : true } }); . Since the requires is missing in the entities, the only recommendable fix is to delete the rogue content pack.

Since these are standard content packs it is easy to replace them. Let me know if I can help you with it.

Greets, Konrad

3

Thanks for your reply Konrad. As mentioned, I was able to delete all these within Mongo db console. But where do you find the standard content packs for v3.1 so I can replace them?

4

I fixed my own issue after exporting the Content Packs from my home Graylog 3.1 install (found no other place from which to get them). Then in Mongo console removed the beta versions after getting their ObjectId with command posted by Konrad.

db.content_packs.remove({
    "_id": {
        $in: [
                  ObjectId("5d5c5e260de4d563aab6e182"),
                  ObjectId("5c13fa1aa7986c034051e5f9"),
            ObjectId("5c13fa1aa7986c034051e5fa"),
            ObjectId("5c13fa1aa7986c034051e5fb"),
            ObjectId("5c13fa1aa7986c034051e5fc"),
            ObjectId("5c13fa1aa7986c034051e5fd"),
            ObjectId("5c13fa1aa7986c034051e5ff")
        ]
     }
})

,
Then was able to access Content Packs screen and upload files I exported from other system.

1 Like
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.