Graylog on single server

Graylog Central (peer support)
1

Hi,

I have configured on AWS ec2 instance Graylog, on Single instance everything is running on single machine, is it creates any problems.

Regards
Sateesh

2

Do you have a specific question?
Maybe elaborate on your problem.

3

Does it creates any problem Web portal, elastic search and gralylog2 on single instance.

Regards
Sateesh

4

No, that should work totally fine if the machine has sufficient resources (e. g. minimum of 4 GB of memory).

5

thank you,

/var/lib/elasticsearch/ currently my data store path is default one if i change to different directory /esdata/data , changed in configuration also vim /etc/elasticsearch/elasticsearch.yml but process is getting failed due to data store path is different.

6

Please elaborate and provide all necessary details to reproduce the issue.

7

want to change default data store index directory

8

after changing the logs and data directory i am getting below error.

Caused by: java.nio.file.AccessDeniedException: /esdata/data/nodes/0/indices/6vNyq9htSXOWBrqL9mgI_A/_state/.es_temp_file
        at sun.nio.fs.UnixException.translateToIOException(UnixException.java:84) ~[?:?]
        at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102) ~[?:?]
        at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107) ~[?:?]
        at sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:214) ~[?:?]
9

Does the system user running Elasticsearch have sufficient permissions to access that path?
What’s the output of the following commands?

# namei -l /esdata/data/nodes/0/indices/
# namei -l /esdata/data/nodes/0/indices/6vNyq9htSXOWBrqL9mgI_A/_state/
# namei -l /esdata/data/nodes/0/indices/6vNyq9htSXOWBrqL9mgI_A/_state/.es_temp_file
10

Thank you its working now

11

Great! What was the problem?

12

Permission issue for particular directory

13

Now after rebooting machine,
getting below error in dashboard
Could not execute search
There was an error executing your search. Please check your Graylog server logs for more information.

Error Message:
Unable to perform search query.
Details:
Search status code:
500
Search response:
cannot GET http://pulicip:9000/api/search/universal/relative?query=*&range=300&limit=150&sort=timestamp%3Adesc (500)

14

Maybe you should do this…
http://docs.graylog.org/en/2.4/pages/configuration/file_location.html

15

Hi,

I am not able to see the full logs, i have installed on client machine nxlog,
in portal shows only the below mentioned out put, not complete logs.

2018-02-23 13:06:19.000 ip-x.x.x.x
[2018-02-23 07:36:19.197][http-nio-8080-exec-4][INFO][c.c.a.d.Us

Regards
Sateesh

16

Sorry, but if you don’t provide the respective logs, we’re unable to help you.

You can probably download the log files from the machine running Graylog (and Elasticsearch) with an SSH or SCP client.

17

Graylog-server logs

ERROR [DecodingProcessor] Error processing message RawMessage{id=0c7f2d47-187d-11e8-828a-02824ea336b6, journalOffset=3264785, codec=gelf, payloadSize=124, timestamp=2018-02-23T09:36:39.444Z, remoteAddress=/x.x.x.x:38659}
com.fasterxml.jackson.core.JsonParseException: Illegal character ((CTRL-CHAR, code 6)): only regular white space (\r, \n, \t) is allowed between tokens

for elasticsearch there is no error
[o.e.c.r.a.AllocationService] [_Y24BH1] Cluster health status changed from [RED] to [GREEN] (reason: [shards started [[graylog_0][0]] …

curl -XGET ‘localhost:9200/_cluster/health?pretty’
{
“cluster_name” : “graylog”,
“status” : “green”,
“timed_out” : false,
“number_of_nodes” : 1,
“number_of_data_nodes” : 1,
“active_primary_shards” : 1,
“active_shards” : 1,
“relocating_shards” : 0,
“initializing_shards” : 0,
“unassigned_shards” : 0,
“delayed_unassigned_shards” : 0,
“number_of_pending_tasks” : 0,
“number_of_in_flight_fetch” : 0,
“task_max_waiting_in_queue_millis” : 0,
“active_shards_percent_as_number” : 100.0

18

This points to an invalid GELF message received by a GELF TCP or UDP input.

19

I am using both side TCP only

Problem is resolved after adding this parameter in ShortMessageLength -1 in nxlog.conf parameter.

20

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.