Graylog server broken after restart

Graylog Central (peer support)
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:
Server restarted overnight and graylog no longer displaying webpage

2. Describe your environment:

  • OS Information:Ubuntu

  • Package Version:5.0

  • Service logs, configurations, and environment variables:

3. What steps have you already taken to try and solve the problem?
Error on traceback here:
2023-04-18T21:26:24.817+10:00 INFO [ImmutableFeatureFlagsCollector] Following feature flags are used: {default properties file=[scripting_api_preview=off, search_filter=on]}
2023-04-18T21:26:25.040+10:00 ERROR [CmdLineTool] Invalid configuration
com.github.joschi.jadconfig.ParameterException: Couldn’t convert value for parameter “root_timezone”
at com.github.joschi.jadconfig.JadConfig.processClassFields(JadConfig.java:136) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.process(JadConfig.java:101) ~[graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:477) [graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.doRun(CmdLineTool.java:282) [graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:260) [graylog.jar:?]
at org.graylog2.bootstrap.Main.main(Main.java:45) [graylog.jar:?]
Caused by: com.github.joschi.jadconfig.ParameterException: Couldn’t convert value “AustraliaBrisbane” to DateTimeZone.
at com.github.joschi.jadconfig.jodatime.converters.DateTimeZoneConverter.convertFrom(DateTimeZoneConverter.java:26) ~[graylog.jar:?]
at com.github.joschi.jadconfig.jodatime.converters.DateTimeZoneConverter.convertFrom(DateTimeZoneConverter.java:12) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.convertStringValue(JadConfig.java:179) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.processClassFields(JadConfig.java:134) ~[graylog.jar:?]

4. How can the community help? I did not change the timezone and it was working previously.
Any suggestions please.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

AustraliaBrisbane is not a valid timezone name - it should be Australia/Brisbane.
Was the root_timezone value modified?
https://www.joda.org/joda-time/timezones.html

1 Like
3

Timezone was not changed. From /etc/graylog/server/server.conf
root_timezone = Australia/Brisbane

Not sure why there is now a config error when there were no changes only a server reboot after security updates.

Thanks for the reply

4

This is the status

andrew@Ubuntu:/var/log/graylog-server$ sudo systemctl status graylog-server.service
● graylog-server.service - Graylog server
Loaded: loaded (/lib/systemd/system/graylog-server.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2023-04-27 18:59:29 AEST; 3s ago
Docs: http://docs.graylog.org/
Main PID: 12499 (graylog-server)
Tasks: 26 (limit: 19066)
Memory: 279.1M
CPU: 6.094s
CGroup: /system.slice/graylog-server.service
├─12499 /bin/sh /usr/share/graylog-server/bin/graylog-server
└─12500 /usr/share/graylog-server/jvm/bin/java -Xms1g -Xmx1g -server -XX:+UseG1GC -XX:-OmitStackTraceInFastThrow -Djdk.tls.acknowledgeCloseNotify=true -Dlog4j2.formatMsgNoLooku>

Apr 27 18:59:29 Ubuntu systemd[1]: Started Graylog server.

Appears to be started correctly but web interface still not showing.

5

and a few minutes later ststus

graylog-server.service - Graylog server
Loaded: loaded (/lib/systemd/system/graylog-server.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2023-04-27 18:59:29 AEST; 8min ago
Docs: http://docs.graylog.org/
Main PID: 12499 (graylog-server)
Tasks: 60 (limit: 19066)
Memory: 433.6M
CPU: 12.056s
CGroup: /system.slice/graylog-server.service
├─12499 /bin/sh /usr/share/graylog-server/bin/graylog-server
└─12500 /usr/share/graylog-server/jvm/bin/java -Xms1g -Xmx1g -server -XX:+UseG1GC -XX:-OmitStackTraceInFastThrow -Djdk.tls.acknowledgeCloseNotify=true -Dlog4j2.formatMsgNoLookups=true -jar -Dlog4j.configurationF>

Apr 27 18:59:34 Ubuntu graylog-server[12500]: ========================
Apr 27 18:59:34 Ubuntu graylog-server[12500]: at com.google.inject.internal.Errors.throwCreationExceptionIfErrorsExist(Errors.java:568)
Apr 27 18:59:34 Ubuntu graylog-server[12500]: at com.google.inject.internal.InternalInjectorCreator.injectDynamically(InternalInjectorCreator.java:190)
Apr 27 18:59:34 Ubuntu graylog-server[12500]: at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:113)
Apr 27 18:59:34 Ubuntu graylog-server[12500]: at com.google.inject.Guice.createInjector(Guice.java:87)
Apr 27 18:59:34 Ubuntu graylog-server[12500]: at org.graylog2.shared.bindings.GuiceInjectorHolder.createInjector(GuiceInjectorHolder.java:34)
Apr 27 18:59:34 Ubuntu graylog-server[12500]: at org.graylog2.bootstrap.CmdLineTool.setupInjector(CmdLineTool.java:502)
Apr 27 18:59:34 Ubuntu graylog-server[12500]: at org.graylog2.bootstrap.CmdLineTool.doRun(CmdLineTool.java:306)
Apr 27 18:59:34 Ubuntu graylog-server[12500]: at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:260)
Apr 27 18:59:34 Ubuntu graylog-server[12500]: at org.graylog2.bootstrap.Main.main(Main.java:45)

6

The original log clearly indicates an issue with the root_timezone. Maybe it’s just one node where the graylog.conf has changed? Or it’s using a conf from a different path via -f commandline parameter?

7

Running a single node only no cluster.
No forcing of commandline that I am aware of. Is this in the .conf file?

8

Yes - root_timezone is a .conf file setting

9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.