Graylog problem after installation

Graylog Central (peer support)
1

Hi,
I’ve just installed Graylog on server Ubuntu 20.04.5 LTS and I’ve a problem with starting service.
I installed exactly with the instructions from that link: Ubuntu installation

Status looks like:

● graylog-server.service - Graylog server
     Loaded: loaded (/lib/systemd/system/graylog-server.service; enabled; vendor preset: enabled)
     Active: activating (auto-restart) (Result: exit-code) since Sat 2022-09-10 10:29:39 UTC; 2s ago
       Docs: http://docs.graylog.org/
    Process: 13862 ExecStart=/usr/share/graylog-server/bin/graylog-server (code=exited, status=1/FAILURE)
   Main PID: 13862 (code=exited, status=1/FAILURE)


2022-09-10T10:27:25.186Z INFO  [ImmutableFeatureFlagsCollector] Following feature flags are used: {}
2022-09-10T10:27:25.954Z INFO  [CmdLineTool] Loaded plugin: AWS plugins 4.3.6 [org.graylog.aws.AWSPlugin]
2022-09-10T10:27:25.956Z INFO  [CmdLineTool] Loaded plugin: Enterprise Integrations 4.3.6 [org.graylog.enterprise.integrations.EnterpriseIntegrationsPlugin]
2022-09-10T10:27:25.958Z INFO  [CmdLineTool] Loaded plugin: Integrations 4.3.6 [org.graylog.integrations.IntegrationsPlugin]
2022-09-10T10:27:25.960Z INFO  [CmdLineTool] Loaded plugin: Collector 4.3.6 [org.graylog.plugins.collector.CollectorPlugin]
2022-09-10T10:27:25.962Z INFO  [CmdLineTool] Loaded plugin: Graylog Enterprise 4.3.6 [org.graylog.plugins.enterprise.EnterprisePlugin]
2022-09-10T10:27:25.963Z INFO  [CmdLineTool] Loaded plugin: Graylog Enterprise (ES6 Support) 4.3.6 [org.graylog.plugins.enterprise.org.graylog.plugins.enterprise.es6.EnterpriseES6Plugin]
2022-09-10T10:27:25.965Z INFO  [CmdLineTool] Loaded plugin: Graylog Enterprise (ES7 Support) 4.3.6 [org.graylog.plugins.enterprise.org.graylog.plugins.enterprise.es7.EnterpriseES7Plugin]
2022-09-10T10:27:25.966Z INFO  [CmdLineTool] Loaded plugin: Threat Intelligence Plugin 4.3.6 [org.graylog.plugins.threatintel.ThreatIntelPlugin]
2022-09-10T10:27:25.966Z INFO  [CmdLineTool] Loaded plugin: Elasticsearch 6 Support 4.3.6+36120cf [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin]
2022-09-10T10:27:25.967Z INFO  [CmdLineTool] Loaded plugin: Elasticsearch 7 Support 4.3.6+36120cf [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin]
2022-09-10T10:27:26.010Z INFO  [CmdLineTool] Running with JVM arguments: -Xms1g -Xmx1g -XX:NewRatio=1 -XX:+ResizeTLAB -XX:-OmitStackTraceInFastThrow -Djdk.tls.acknowledgeCloseNotify=true -Dlog4j2.formatMsgNoLookups=true -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -Dlog4j.configurationFile=file:///etc/graylog/server/log4j2.xml -Djava.library.path=/usr/share/graylog-server/lib/sigar -Dgraylog2.installation_source=deb
2022-09-10T10:27:26.531Z INFO  [cluster] Cluster created with settings {hosts=[localhost:27017], mode=SINGLE, requiredClusterType=UNKNOWN, serverSelectionTimeout='30000 ms', maxWaitQueueSize=5000}
2022-09-10T10:27:26.599Z INFO  [cluster] Cluster description not yet available. Waiting for 30000 ms before timing out
2022-09-10T10:27:26.629Z INFO  [connection] Opened connection [connectionId{localValue:1, serverValue:165}] to localhost:27017
2022-09-10T10:27:26.640Z INFO  [cluster] Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, version=ServerVersion{versionList=[4, 0, 28]}, minWireVersion=0, maxWireVersion=7, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=7775275}
2022-09-10T10:27:26.665Z INFO  [connection] Opened connection [connectionId{localValue:2, serverValue:166}] to localhost:27017
2022-09-10T10:27:26.699Z INFO  [connection] Closed connection [connectionId{localValue:2, serverValue:166}] to localhost:27017 because the pool has been closed.
2022-09-10T10:27:26.702Z INFO  [MongoDBPreflightCheck] Connected to MongoDB version 4.0.28
2022-09-10T10:27:26.848Z INFO  [SearchDbPreflightCheck] Connected to (Elastic/Open)Search version <Elasticsearch:7.10.2>
2022-09-10T10:27:26.896Z ERROR [PreflightCheckService] Preflight check failed with error: Journal directory </var/lib/graylog-server/journal> has not enough free space (2793 MB) to contain 'message_journal_max_size = 12288 MB'

What is wrong with that?

JS

2

You should either increase the amount of disk space available for the Journal directory (/var/lib/graylog-server/journal ), or change the message_journal_max_size to a lower value in the server.conf Graylog configuration file.

2022-09-10T10:27:26.896Z ERROR [PreflightCheckService] Preflight check failed with error: Journal directory </var/lib/graylog-server/journal> has not enough free space (2793 MB) to contain ‘message_journal_max_size = 12288 MB’

1 Like
3

Thank you for your answer.
I did it before when I had such a mistake :

2022-09-10T10:12:03.690Z ERROR [PreflightCheckService] Preflight check failed with error: Journal directory </var/lib/graylog-server/journal> has not enough free space (2793 MB) to contain 'message_journal_max_size = 5120 MB'

Now I’ve

message_journal_max_size = 12gb
4

Ok :slight_smile:
set message_journal_max_size to lower value. That was it

I’ve changed it and it works :slight_smile:

Thx
JS

1 Like
5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.