I have an issue about graylog license,
in the morning i had change DNS on server ubuntu running graylog and after i have this alert:
Graylog Enterprise License Violation
i had change DNS to 8.8.8.8 and graylog still not runing
Same here but without changing anything.
Tried to restart several time but still same error.
curl -SI https://api.graylog.com
work.
HTTP/1.1 200 OK
Date: Fri, 04 Jul 2025 11:24:23 GMT
Content-Type: text/plain
Content-Length: 133
Connection: keep-alive
CF-RAY: 959e4185eaa59ed5-CDG
Report-To: {"group":"heroku-nel","max_age":3600,"endpoints":[{"url":"https://nel.heroku.com/reports?ts=1751628263&sid=67ff5de4-ad2b-4112-9289-cf96be89efed&s=i%2BU38COARNUbCHmRpVlkVgbvaqUwvZI49Kc18PKH3Sk%3D"}]}
Reporting-Endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1751628263&sid=67ff5de4-ad2b-4112-9289-cf96be89efed&s=i%2BU38COARNUbCHmRpVlkVgbvaqUwvZI49Kc18PKH3Sk%3D
Nel: {"report_to":"heroku-nel","max_age":3600,"success_fraction":0.005,"failure_fraction":0.05,"response_headers":["Via"]}
Via: 1.1 vegur
cf-cache-status: DYNAMIC
expect-ct: max-age=86400, enforce
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
Server: cloudflare
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=5057&min_rtt=5025&rtt_var=1473&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2355&recv_bytes=698&delivery_rate=547861&cwnd=251&unsent_bytes=0&cid=ed23ca0755f2a5ce&ts=318&x=0"
2025-07-04 13:19:03,432 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:20:22,049 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:20:22,174 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:21:03,429 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:22:32,869 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:22:33,217 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:23:02,429 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:23:02,483 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:23:02,520 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:23:02,573 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:23:03,436 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:23:03,449 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
2025-07-04 13:23:03,462 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 75, limit: 72
Hello everyone,
i got the same Problem, but without changing anything.
DNS is fine, Ping is fine, curls are working fine to http(s)://api.graylog.com (http is 301 redirect to https, https answers with:
curl -v https://api.graylog.com/
* Trying 172.66.43.195:443...
[...]
* Server certificate:
* subject: CN=api.graylog.com
* start date: Jun 5 23:06:51 2025 GMT
* expire date: Sep 3 23:06:50 2025 GMT
* subjectAltName: host "api.graylog.com" matched cert's "api.graylog.com"
* issuer: C=US; O=Let's Encrypt; CN=E5
* SSL certificate verify ok.
[...]
You have reached the Graylog, Inc API. Please contact Graylog support for assistance or visit https://www.graylog.org/ to learn more.
curl -v https://api.graylog.com/releases/active
[...]
{"version":{"major":6,"minor":3,"patch":0},"suffix":"","codename":"Noir","released_at":"2025-06-30T00:00:00Z","announcement_link":"https://graylog.org/post/announcing-graylog-6-3/","published":true}
server-time is correct inclusive TZ (CEST), License was installed on 2025-05-06, is valid until 2026-05-06.
Traffic shows about 1,6GB/Day.
Server-Logs shows:
2025-07-04T15:14:04.484+02:00 WARN [LicenseChecker] License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 77, limit: 72
i cant use any enterprise-features inclusive Team-Management.
Our permission-model is purely based on the teams and no one can access graylog anymore.
Only users who got the permissions bound directly to user instead of team can do something.
PS:
i just checked logs, the first time a License-Violation was found was:
2025-06-26T10:19:18.192+02:00 INFO [Periodicals] Starting [org.graylog.plugins.license.LicenseReportPeriodical] periodical in [300s], polling every [3600s]. ### Last time a License-check was started without followed by an error.
## Next message regarding License:
2025-07-01T12:24:18.624+02:00 WARN [LicenseReportPeriodical] License server response is invalid.
## On restarting graylog-server:
2025-07-04T14:50:25.313+02:00 INFO [Periodicals] Starting [org.graylog.plugins.license.LicenseReportPeriodical] periodical in [300s], polling every [3600s].
2025-07-04T14:55:25.758+02:00 WARN [LicenseReportPeriodical] License server response is invalid.
Since then we only got invalid responses
best regards
coffee_is_life
Same issue here totally dead as our O365 connectors are now down.
Tried creating a new node id and requesting a new license, no change.
graylog | 2025-07-04 11:24:25,584 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 82, limit: 72
graylog | 2025-07-04 11:24:25,594 WARN : org.graylog.plugins.license.LicenseChecker - License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 82, limit: 72
graylog | 2025-07-04 11:24:25,958 WARN : org.graylog.plugins.license.LicenseReportPeriodical - License server response is invalid.
graylog | 2025-07-04 11:24:31,634 ERROR: org.graylog.plugins.auditlog.AuditLogger - Unable to write audit log entry because there is no valid license.
graylog | 2025-07-04 11:24:34,683 INFO : org.graylog2.periodical.Periodicals - Shutting down periodical [org.graylog.plugins.license.LicenseManagerPeriodical].
graylog | 2025-07-04 11:24:34,684 INFO : org.graylog2.periodical.Periodicals - Shutting down periodical [org.graylog.plugins.license.LicenseReportPeriodical].
graylog | 2025-07-04 11:24:34,684 INFO : org.graylog2.periodical.Periodicals - Shutting down periodical [org.graylog.plugins.license.drawdown.DrawdownLicenseCheckoutPeriodical].
graylog | 2025-07-04 11:24:34,684 INFO : org.graylog2.periodical.Periodicals - Shutting down periodical [org.graylog.plugins.license.drawdown.traffic.DrawdownLicenseTrafficPeriodical].
graylog | 2025-07-04 11:24:34,693 ERROR: org.graylog.plugins.auditlog.AuditLogger - Unable to write audit log entry because there is no valid license.
Something is broken, I am suffering the same problem. Suddenly license checks are failing.
I am running 6.3 on FreeBSD. Everything was working like a charm.
I have been checking my DNS logs and I don’t have a single DNS query error for the graylog.com domain.
Also I don’t think I have connectivity problems with CloudFlare. I connect with both IPv4 and IPv6.
The first failure I noticed happened on 2025-07-01 10:09:52 (UTC)
WARN o.g.p.l.LicenseReportPeriodical [scheduled-daemon-10] License server response is invalid.
And now it is happening hourly.
Did anything happen on Graylog API servers on June 30th? I am checking the amount of data exchanged per hour with them (Netflow records) and I see that the pattern seems to be different.
Just to add another voice to the chorus, we’ve started also having the same issue as of July 2nd with no changes to our instance.
Same here - no change to my network and now it says License violation.
Looks like Cloudflare is causing the problem
curl -SI https://api.graylog.com
gave me
HTTP/2 200
date: Sun, 06 Jul 2025 09:33:00 GMT
content-type: text/plain
content-length: 133
cf-ray: 95ae1917bdbf3c68-KUL
report-to: {“group”:“heroku-nel”,“max_age”:3600,“endpoints”:[{“url”:“https://nel.heroku.com/reports?ts=1751794380&sid=67ff5de4-ad2b-4112-9289-cf96be89efed&s=fA5ps46Wb2p1XaYBqKDsY5rgGPi7mcKyueAUpYo9upE%3D”}]}
reporting-endpoints: heroku-nel=https://nel.heroku.com/reports?ts=1751794380&sid=67ff5de4-ad2b-4112-9289-cf96be89efed&s=fA5ps46Wb2p1XaYBqKDsY5rgGPi7mcKyueAUpYo9upE%3D
nel: {“report_to”:“heroku-nel”,“max_age”:3600,“success_fraction”:0.005,“failure_fraction”:0.05,“response_headers”:[“Via”]}
via: 1.1 vegur
cf-cache-status: DYNAMIC
expect-ct: max-age=86400, enforce
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
server: cloudflare
alt-svc: h3=“:443”; ma=86400
server-timing: cfL4;desc=“?proto=TCP&rtt=5256&min_rtt=5148&rtt_var=1630&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2919&recv_bytes=759&delivery_rate=504466&cwnd=253&unsent_bytes=0&cid=d92495e00bb8ed91&ts=745&x=0”
Is there any way to fix this problem everyone?
Graylog 5.0.13+083613e on iphidden (Eclipse Adoptium 17.0.8 on Linux 5.15.158-2-pve)
2025-07-06T17:47:21.694+02:00 WARN [LicenseChecker] License violation - Failed to report license status to Graylog, Inc. - consecutive failures: 110, limit: 72
2025-07-06T17:47:23.098+02:00 ERROR [AuditLogger] Unable to write audit log entry because there is no valid license.
Unfortunately, we are experiencing the same issue. We haven’t made any changes to our configuration, and even after temporarily disabling the firewall for testing purposes, there was no improvement.
Issue has been resolved
For me it begun working yesterday, Jul 6th after 15:49 UTC. This was the last error it registered
2025-07-06 15:49:58,321 WARN o.g.p.f.h.EnterpriseInputFailureHandler [FailureHandlingService] No valid license found for the Enterprise Failure handler. Failures will be skipped.
Maybe the fact that I tried to genrate a new license made it worse? No idea.
Now, I know this is the free license so no real reason to complain.
However, given that we are in the process of upgrading to Graylog Security I would like to know whether such a problem might affect a commercial license. This outage was several days long.
Although it does not affect us for now, Cloudflare is having serious legal issues in Spain (someone was successful at deceiving a judge) the fact is that courts are issuing orders to certain ISPs restricting access to CloudFlare IP addresses. That could spell disaster for some users.
Hello again, the failure seems to be resolved. - At my Instance the last error occured at “2025-07-06T18:04:04.481+02:00”
Apparently a wrong certificate was uploaded to the license server - sorry for the disruption.