Graylog service fails after upgrade to Graylog 4

[dani (Daniel)]

Hello everyone,
I upgraded Graylog 3.3.8 to 4 from package, kept existing conf file, but the service fails after a few seconds.
● graylog-server.service - Graylog server
Loaded: loaded (/usr/lib/systemd/system/graylog-server.service; enabled; vendor preset: enabled)
Active: activating (auto-restart) (Result: exit-code) since Thu 2021-01-28 21:23:19 CET; 8s ago
Docs: http://docs.graylog.org/
Process: 17311 ExecStart=/usr/share/graylog-server/bin/graylog-server (code=exited, status=1/FAILURE)
Main PID: 17311 (code=exited, status=1/FAILURE)

Jan 28 21:23:19 ubuntu_1804 systemd[1]: graylog-server.service: Failed with result ‘exit-code’.

Log
2021-01-28T21:04:53.921+01:00 INFO [Version] HV000001: Hibernate Validator null
2021-01-28T21:05:11.360+01:00 INFO [CmdLineTool] Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin]
2021-01-28T21:05:11.369+01:00 INFO [CmdLineTool] Loaded plugin: Enterprise Integrations 3.2.6 [org.graylog.enterprise.integrations.EnterpriseIntegrationsPlugin]
2021-01-28T21:05:11.372+01:00 INFO [CmdLineTool] Loaded plugin: Integrations 3.2.6 [org.graylog.integrations.IntegrationsPlugin]
2021-01-28T21:05:11.375+01:00 INFO [CmdLineTool] Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin]
2021-01-28T21:05:11.378+01:00 INFO [CmdLineTool] Loaded plugin: Graylog Enterprise 3.2.6 [org.graylog.plugins.enterprise.EnterprisePlugin]
2021-01-28T21:05:11.380+01:00 INFO [CmdLineTool] Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin]
2021-01-28T21:05:11.381+01:00 INFO [CmdLineTool] Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin]
2021-01-28T21:05:11.382+01:00 INFO [CmdLineTool] Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin]
2021-01-28T21:05:11.987+01:00 INFO [CmdLineTool] Running with JVM arguments: -Xms1g -Xmx1g -XX:NewRatio=1 -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:-OmitStackTraceInFastThrow -Djdk.tls.acknowledgeCloseNotify=true -XX:+UseParNewGC -Dlog4j.configurationFile=file:///etc/graylog/server/log4j2.xml -Djava.library.path=/usr/share/graylog-server/lib/sigar -Dgraylog2.installation_source=deb
2021-01-28T21:05:12.750+01:00 INFO [Version] HV000001: Hibernate Validator null

Elasticsearch Version: 6.8.13
MongoDB Version: 4.0.21
both services are running

any hints? thanks

[ttsandrew]

Hey @dani, welcome!

Any errors in your server.log? I don’t see anything in what you pasted.

Also check your Java version.

[dani (Daniel)]

Hey Andrew - no error in the log, the service tries to start again but fails again, the few lines between ‘Hibernate Validator null’ is all I get.

I have Java:
openjdk version “1.8.0_275”
OpenJDK Runtime Environment (build 1.8.0_275-8u275-b01-0ubuntu1~18.04-b01)
OpenJDK 64-Bit Server VM (build 25.275-b01, mixed mode)

[ttsandrew]

Hmm, OpenJDK 8 is supported. And no errors. Anything in your system logs?

Did you get any errors while updating?

What all are you setting in your server conf?

[shoothub]

Please upgrade also packages for integration and enterprise, you still have it in old version 3.2.6, so graylog crash.
Run:
sudo apt-get upgrade graylog-enterprise-plugins graylog-integrations-plugins graylog-enterprise-integrations-plugins

[dani (Daniel)]

Thanks, that’s the solution! So far I haven’t used interations or enterprise. But it seems to be installed.

btw in syslog I found
Jan 29 12:04:46 ubuntu_1804 graylog-server[13952]: Exception in thread “main” java.lang.NoClassDefFoundError: org/graylog/plugins/views/search/elasticsearch/ESQueryDecorator

that would have pointed me into the wrong direction