Graylog sidecar errors

[rafaliwaniak]

Hi guys,

I’ve got a problem with launching my graylog collector sidecar. Below is my console (run as administrator):

C:\Program Files\Graylog\collector-sidecar>java -version
java version "1.7.0_80"             // comment - Beacuase of my app I need to have this version of java
Java(TM) SE Runtime Environment (build 1.7.0_80-b15)
Java HotSpot(TM) Client VM (build 24.80-b11, mixed mode, sharing)

C:\Program Files\Graylog\collector-sidecar>ls -l
    total 34668
    -rw-r--r-- 1 vagrant 197121    35147 Mar 16 13:10 COPYING
    -rwxr-xr-x 1 vagrant 197121  5906432 Mar 16 13:10 Graylog-collector-sidecar.exe
    -rw-r--r-- 1 vagrant 197121      715 Jun  7 15:44 collector_sidecar.yml
    -rw-r--r-- 1 vagrant 197121     1033 Mar 16 13:10 collector_sidecar.yml.dist
    -rwxr-xr-x 1 vagrant 197121 15088128 Dec  6  2016 filebeat.exe
    drwxr-xr-x 1 vagrant 197121        0 Jun  7 15:43 generated
    -rw-r--r-- 1 vagrant 197121    73254 Mar 16 13:10 graylog.ico
    drwxr-xr-x 1 vagrant 197121        0 Jun  7 15:43 logs
    -rwxr-xr-x 1 vagrant 197121   157345 Jun  7 15:43 uninstall.exe
    -rwxr-xr-x 1 vagrant 197121 14221824 Dec  6  2016 winlogbeat.exe

    C:\Program Files\Graylog\collector-sidecar>Graylog-collector-sidecar.exe -service install
    Failed service action: Failed to install Graylog collector sidecar: service collector-sidecar already exists
    C:\Program Files\Graylog\collector-sidecar>Graylog-collector-sidecar.exe -service start
    Failed service action: Failed to start Graylog collector sidecar: The service did not respond to the start or control request in a timely fashion.

This is my collector_sidecar.yml:
C:\Program Files\Graylog\collector-sidecar>cat collector_sidecar.yml
server_url: http://ip.of.my.graylog:9000/api
update_interval: 10
tls_skip_verify: false
send_status: true
list_log_files:C:\path\to\my\log\folder\test.log
node_id: MySidecar
collector_id: file:C:\Program Files\graylog\collector-sidecar\collector-id
cache_path: C:\Program Files\graylog\collector-sidecar\cache
log_path: C:\Program Files\graylog\collector-sidecar\logs
log_rotation_time: 86400
log_max_age: 604800
tags: [windows, iis]
backends:
- name: filebeat
enabled: true
binary_path: C:\Program Files\graylog\collector-sidecar\filebeat.exe
configuration_path: C:\Program Files\graylog\collector-sidecar\generated\filebeat.yml

I have Windows 10 Enterprise OS. I can ping my graylog ip address.

Really bad is that I had the same problem last week and I solved this issue but unfortunatelly I deleted my virtual machine where I had this solution

Do you have, guys, any idea what am I doing wrong?

[jan (Jan Doberstein)]

first - collector sidecar is go. you do not need to have java installed.
second - what did the configured log file tells you?
third - is the server_url the configured (and reachable) rest_listen_uri of your Graylog?

[rafaliwaniak]

You were right - checking java was pointless.

third - yes it is.

Nevertheless, I found the problem. Problem was with collector_sidecar.yml file. Especially in line: list_log_files

My solution: erase this path, just leave it empty. If you want to indicate what files you want to watch, there is another place to write it:

System->Collectors->Manage configuration->[your collector]->[your input]->edit->Path to Logfile -> this is this place where you can indicate your log files. However you need to write exact path to file, not to folder, unfortunatelly.

I noticed that last week, but (as I said) by mistake I deleted my virtual machine.

PS. Thanks Jan for you help