Graylog v4.0 Web Interface

gsmith · November 20, 2020, 1:24am

All,
Just want to ask a question if any one has come across this problem before, right now im still working on it and its becoming frustrating.

Graylog Environment.

Graylog 4.0.0+9376305 on graylog.enseva-labs.net (Red Hat, Inc. 1.8.0_272 on Linux 3.10.0-1160.6.1.el7.x86_64)
MongoDB “version": “4.4.1”
Elasticsearch “6.8.12”
CentOS Linux release 7.8.2003 (Core), 8 CPU’s, 8 GB memory, 1TB HDD (Virtual Machine).

After upgrading Graylog in the lab to 4.0 ran into a problem logging in using Chrome.

but its fine with other browsers like internet explorer.

Works on Firefox

Even thou this is my desktop I had other tech/s try it also and they had the same out come, Chrome doesnt connect

Graylog Log file after a restart.

2020-11-19T18:34:11.668-06:00 INFO  [NetworkListener] Stopped listener bound to [graylog.enseva-labs.net:9000]
2020-11-19T18:34:11.768-06:00 INFO  [LogManager] Shutdown complete.
2020-11-19T18:34:11.847-06:00 INFO  [ServiceManagerListener] Services are now stopped.
2020-11-19T18:34:14.392-06:00 INFO  [CmdLineTool] Loaded plugin: AWS plugins 4.0.0 [org.graylog.aws.AWSPlugin]
2020-11-19T18:34:14.399-06:00 INFO  [CmdLineTool] Loaded plugin: Collector 4.0.0 [org.graylog.plugins.collector.CollectorPlugin]
2020-11-19T18:34:14.400-06:00 INFO  [CmdLineTool] Loaded plugin: Threat Intelligence Plugin 4.0.0 [org.graylog.plugins.threatintel.ThreatIntelPlugin]
2020-11-19T18:34:14.401-06:00 INFO  [CmdLineTool] Loaded plugin: Elasticsearch 6 Support 4.0.0+9376305 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin]
2020-11-19T18:34:14.402-06:00 INFO  [CmdLineTool] Loaded plugin: Elasticsearch 7 Support 4.0.0+9376305 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin]
2020-11-19T18:34:14.931-06:00 INFO  [CmdLineTool] Running with JVM arguments: -Xms1g -Xmx1g -XX:NewRatio=1 -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:-OmitStackTraceInFastThrow -Djdk.tls.acknowledgeCloseNotify=true -XX:+UseParNewGC -Dlog4j.configurationFile=file:///etc/graylog/server/log4j2.xml -Djava.library.path=/usr/share/graylog-server/lib/sigar -Dgraylog2.installation_source=rpm
2020-11-19T18:34:15.280-06:00 INFO  [Version] HV000001: Hibernate Validator null
2020-11-19T18:34:20.636-06:00 INFO  [InputBufferImpl] Message journal is enabled.
2020-11-19T18:34:20.672-06:00 INFO  [NodeId] Node ID: 8e947fe4-fe2a-48a3-9f2c-786652326c9a
2020-11-19T18:34:20.983-06:00 INFO  [LogManager] Loading logs.
2020-11-19T18:34:21.063-06:00 INFO  [LogManager] Logs loading complete.
2020-11-19T18:34:21.070-06:00 INFO  [KafkaJournal] Initialized Kafka based journal at /var/lib/graylog-server/journal
2020-11-19T18:34:21.102-06:00 INFO  [cluster] Cluster created with settings {hosts=[localhost:27017], mode=SINGLE, requiredClusterType=UNKNOWN, serverSelectionTimeout='30000 ms', maxWaitQueueSize=5000}
2020-11-19T18:34:21.238-06:00 INFO  [cluster] Cluster description not yet available. Waiting for 30000 ms before timing out
2020-11-19T18:34:21.265-06:00 INFO  [connection] Opened connection [connectionId{localValue:1, serverValue:80}] to localhost:27017
2020-11-19T18:34:21.271-06:00 INFO  [cluster] Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, version=ServerVersion{versionList=[4, 4, 2]}, minWireVersion=0, maxWireVersion=9, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=4137654}
2020-11-19T18:34:21.405-06:00 INFO  [connection] Opened connection [connectionId{localValue:2, serverValue:81}] to localhost:27017
2020-11-19T18:34:21.691-06:00 INFO  [InputBufferImpl] Initialized InputBufferImpl with ring size <65536> and wait strategy <BlockingWaitStrategy>, running 2 parallel message handlers.
2020-11-19T18:34:22.058-06:00 INFO  [ElasticsearchVersionProvider] Elasticsearch cluster is running v6.8.13
2020-11-19T18:34:22.117-06:00 INFO  [AbstractJestClient] Setting server pool to a list of 1 servers: [http://10.200.6.70:9200]
2020-11-19T18:34:22.118-06:00 INFO  [JestClientFactory] Using multi thread/connection supporting pooling connection manager
2020-11-19T18:34:22.213-06:00 INFO  [JestClientFactory] Using custom ObjectMapper instance
2020-11-19T18:34:22.214-06:00 INFO  [JestClientFactory] Node Discovery disabled...
2020-11-19T18:34:22.214-06:00 INFO  [JestClientFactory] Idle connection reaping disabled...
2020-11-19T18:34:22.905-06:00 INFO  [ProcessBuffer] Initialized ProcessBuffer with ring size <65536> and wait strategy <BlockingWaitStrategy>.
2020-11-19T18:34:23.406-06:00 INFO  [OutputBuffer] Initialized OutputBuffer with ring size <65536> and wait strategy <BlockingWaitStrategy>.
2020-11-19T18:34:23.484-06:00 INFO  [connection] Opened connection [connectionId{localValue:3, serverValue:82}] to localhost:27017
2020-11-19T18:34:24.758-06:00 INFO  [ServerBootstrap] Graylog server 4.0.0+9376305 starting up
2020-11-19T18:34:24.759-06:00 INFO  [ServerBootstrap] JRE: Red Hat, Inc. 1.8.0_272 on Linux 3.10.0-1160.6.1.el7.x86_64
2020-11-19T18:34:24.759-06:00 INFO  [ServerBootstrap] Deployment: rpm
2020-11-19T18:34:24.759-06:00 INFO  [ServerBootstrap] OS: CentOS Linux 7 (Core) (centos)
2020-11-19T18:34:24.759-06:00 INFO  [ServerBootstrap] Arch: amd64
2020-11-19T18:34:24.785-06:00 INFO  [PeriodicalsService] Starting 30 periodicals ...
2020-11-19T18:34:24.787-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ThroughputCalculator] periodical in [0s], polling every [1s].
2020-11-19T18:34:24.796-06:00 INFO  [Periodicals] Starting [org.graylog.plugins.pipelineprocessor.periodical.LegacyDefaultStreamMigration] periodical, running forever.
2020-11-19T18:34:24.808-06:00 INFO  [PeriodicalsService] Not starting [org.graylog2.periodical.AlertScannerThread] periodical. Not configured to run on this node.
2020-11-19T18:34:24.808-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.BatchedElasticSearchOutputFlushThread] periodical in [0s], polling every [1s].
2020-11-19T18:34:24.821-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ClusterHealthCheckThread] periodical in [120s], polling every [20s].
2020-11-19T18:34:24.821-06:00 INFO  [LegacyDefaultStreamMigration] Legacy default stream has no connections, no migration needed.
2020-11-19T18:34:24.822-06:00 INFO  [PeriodicalsService] Not starting [org.graylog2.periodical.ContentPackLoaderPeriodical] periodical. Not configured to run on this node.
2020-11-19T18:34:24.825-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.GarbageCollectionWarningThread] periodical, running forever.
2020-11-19T18:34:24.826-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexerClusterCheckerThread] periodical in [0s], polling every [30s].
2020-11-19T18:34:24.829-06:00 INFO  [connection] Opened connection [connectionId{localValue:4, serverValue:83}] to localhost:27017
2020-11-19T18:34:24.830-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexRetentionThread] periodical in [0s], polling every [300s].
2020-11-19T18:34:24.830-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexRotationThread] periodical in [0s], polling every [10s].
2020-11-19T18:34:24.831-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.NodePingThread] periodical in [0s], polling every [1s].
2020-11-19T18:34:24.837-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.VersionCheckThread] periodical in [300s], polling every [1800s].
2020-11-19T18:34:24.838-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ThrottleStateUpdaterThread] periodical in [1s], polling every [1s].
2020-11-19T18:34:24.839-06:00 INFO  [Periodicals] Starting [org.graylog2.events.ClusterEventPeriodical] periodical in [0s], polling every [1s].
2020-11-19T18:34:24.845-06:00 INFO  [Periodicals] Starting [org.graylog2.events.ClusterEventCleanupPeriodical] periodical in [0s], polling every [86400s].
2020-11-19T18:34:24.849-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ClusterIdGeneratorPeriodical] periodical, running forever.
2020-11-19T18:34:24.849-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexRangesMigrationPeriodical] periodical, running forever.
2020-11-19T18:34:24.852-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexRangesCleanupPeriodical] periodical in [15s], polling every [3600s].
2020-11-19T18:34:24.863-06:00 INFO  [connection] Opened connection [connectionId{localValue:7, serverValue:85}] to localhost:27017
2020-11-19T18:34:24.864-06:00 INFO  [connection] Opened connection [connectionId{localValue:8, serverValue:87}] to localhost:27017
2020-11-19T18:34:24.869-06:00 INFO  [connection] Opened connection [connectionId{localValue:10, serverValue:89}] to localhost:27017
2020-11-19T18:34:24.874-06:00 INFO  [connection] Opened connection [connectionId{localValue:9, serverValue:88}] to localhost:27017
2020-11-19T18:34:24.875-06:00 INFO  [connection] Opened connection [connectionId{localValue:6, serverValue:86}] to localhost:27017
2020-11-19T18:34:24.875-06:00 INFO  [connection] Opened connection [connectionId{localValue:5, serverValue:84}] to localhost:27017
2020-11-19T18:34:24.876-06:00 INFO  [PeriodicalsService] Not starting [org.graylog2.periodical.UserPermissionMigrationPeriodical] periodical. Not configured to run on this node.
2020-11-19T18:34:24.876-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ConfigurationManagementPeriodical] periodical, running forever.
2020-11-19T18:34:24.885-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexFailuresPeriodical] periodical, running forever.
2020-11-19T18:34:24.886-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.TrafficCounterCalculator] periodical in [0s], polling every [1s].
2020-11-19T18:34:24.890-06:00 INFO  [Periodicals] Starting [org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical] periodical in [0s], polling every [3600s].
2020-11-19T18:34:24.893-06:00 INFO  [Periodicals] Starting [org.graylog.scheduler.periodicals.ScheduleTriggerCleanUp] periodical in [120s], polling every [86400s].
2020-11-19T18:34:24.894-06:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ESVersionCheckPeriodical] periodical in [0s], polling every [30s].
2020-11-19T18:34:24.901-06:00 INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredSidecarsThread] periodical in [0s], polling every [600s].
2020-11-19T18:34:24.902-06:00 INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredConfigurationUploads] periodical in [0s], polling every [600s].
2020-11-19T18:34:24.912-06:00 INFO  [Periodicals] Starting [org.graylog.plugins.views.search.db.SearchesCleanUpJob] periodical in [3600s], polling every [28800s].
2020-11-19T18:34:24.913-06:00 INFO  [Periodicals] Starting [org.graylog.events.periodicals.EventNotificationStatusCleanUp] periodical in [120s], polling every [86400s].
2020-11-19T18:34:24.915-06:00 INFO  [Periodicals] Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2020-11-19T18:34:24.981-06:00 INFO  [LookupTableService] Data Adapter abuse-ch-ransomware-domains/5a501ec3ffe8b12df3bcc468 [@227e17de] STARTING
2020-11-19T18:34:24.985-06:00 INFO  [LookupTableService] Data Adapter whois/5a501ec3ffe8b12df3bcc46d [@38659bc5] STARTING
2020-11-19T18:34:24.986-06:00 INFO  [LookupTableService] Data Adapter otx-api-domain/5a501ec3ffe8b12df3bcc470 [@53de141f] STARTING
2020-11-19T18:34:24.986-06:00 INFO  [LookupTableService] Data Adapter tor-exit-node/5a501ec3ffe8b12df3bcc46c [@7eff159a] STARTING
2020-11-19T18:34:24.986-06:00 INFO  [LookupTableService] Data Adapter otx-api-ip/5a501ec3ffe8b12df3bcc46a [@525b12fb] STARTING
2020-11-19T18:34:24.987-06:00 WARN  [OTXDataAdapter] OTX API key is missing. Make sure to add the key to allow higher request limits.
2020-11-19T18:34:24.987-06:00 WARN  [OTXDataAdapter] OTX API key is missing. Make sure to add the key to allow higher request limits.
2020-11-19T18:34:24.992-06:00 INFO  [LookupTableService] Data Adapter abuse-ch-ransomware-ip/5a501ec3ffe8b12df3bcc469 [@1883eb08] STARTING
2020-11-19T18:34:25.011-06:00 INFO  [LookupTableService] Data Adapter otx-api-domain/5a501ec3ffe8b12df3bcc470 [@53de141f] RUNNING
2020-11-19T18:34:25.011-06:00 INFO  [LookupTableService] Data Adapter otx-api-ip/5a501ec3ffe8b12df3bcc46a [@525b12fb] RUNNING
2020-11-19T18:34:25.011-06:00 INFO  [LookupTableService] Data Adapter whois/5a501ec3ffe8b12df3bcc46d [@38659bc5] RUNNING
2020-11-19T18:34:25.012-06:00 INFO  [LookupTableService] Data Adapter spamhaus-drop/5a501ec3ffe8b12df3bcc46f [@7ffb624] STARTING
2020-11-19T18:34:25.012-06:00 INFO  [LookupTableService] Data Adapter geo-locator/5deb235a83d72ece8f020fa7 [@34928009] STARTING
2020-11-19T18:34:25.020-06:00 INFO  [LookupTableService] Data Adapter geo-locator/5deb235a83d72ece8f020fa7 [@34928009] RUNNING
2020-11-19T18:34:25.345-06:00 INFO  [LookupDataAdapterRefreshService] Adding job for <geo-locator/5deb235a83d72ece8f020fa7/@34928009> [interval=60000ms]
2020-11-19T18:34:25.506-06:00 INFO  [LookupTableService] Cache otx-api-ip-cache/5a501ec3ffe8b12df3bcc463 [@2a8e78be] STARTING
2020-11-19T18:34:25.507-06:00 INFO  [LookupTableService] Cache spamhaus-e-drop-cache/5a501ec3ffe8b12df3bcc466 [@8e52510] STARTING
2020-11-19T18:34:25.509-06:00 INFO  [LookupTableService] Cache whois-cache/5a501ec3ffe8b12df3bcc465 [@75d0fb32] STARTING
2020-11-19T18:34:25.509-06:00 INFO  [LookupTableService] Cache whois-cache/5a501ec3ffe8b12df3bcc465 [@75d0fb32] RUNNING
2020-11-19T18:34:25.509-06:00 INFO  [LookupTableService] Cache spamhaus-e-drop-cache/5a501ec3ffe8b12df3bcc466 [@8e52510] RUNNING
2020-11-19T18:34:25.509-06:00 INFO  [LookupTableService] Cache otx-api-ip-cache/5a501ec3ffe8b12df3bcc463 [@2a8e78be] RUNNING
2020-11-19T18:34:25.517-06:00 INFO  [LookupTableService] Cache otx-api-domain-cache/5a501ec3ffe8b12df3bcc464 [@1492a11] STARTING
2020-11-19T18:34:25.517-06:00 INFO  [LookupTableService] Cache threat-intel-uncached-adapters/5a501ec3ffe8b12df3bcc462 [@769dd917] STARTING
2020-11-19T18:34:25.517-06:00 INFO  [LookupTableService] Cache otx-api-domain-cache/5a501ec3ffe8b12df3bcc464 [@1492a11] RUNNING
2020-11-19T18:34:25.518-06:00 INFO  [LookupTableService] Cache geoip/5f28d50c654a4710e38da6eb [@51f7e73a] STARTING
2020-11-19T18:34:25.522-06:00 INFO  [LookupTableService] Cache threat-intel-uncached-adapters/5a501ec3ffe8b12df3bcc462 [@769dd917] RUNNING
2020-11-19T18:34:25.522-06:00 INFO  [LookupTableService] Cache geoip/5f28d50c654a4710e38da6eb [@51f7e73a] RUNNING
2020-11-19T18:34:25.976-06:00 INFO  [LookupTableService] Data Adapter abuse-ch-ransomware-ip/5a501ec3ffe8b12df3bcc469 [@1883eb08] RUNNING
2020-11-19T18:34:25.976-06:00 INFO  [LookupTableService] Data Adapter abuse-ch-ransomware-domains/5a501ec3ffe8b12df3bcc468 [@227e17de] RUNNING
2020-11-19T18:34:25.981-06:00 INFO  [LookupDataAdapterRefreshService] Adding job for <abuse-ch-ransomware-domains/5a501ec3ffe8b12df3bcc468/@227e17de> [interval=150000ms]
2020-11-19T18:34:25.982-06:00 INFO  [LookupDataAdapterRefreshService] Adding job for <abuse-ch-ransomware-ip/5a501ec3ffe8b12df3bcc469/@1883eb08> [interval=150000ms]
2020-11-19T18:34:26.082-06:00 INFO  [LookupTableService] Data Adapter spamhaus-drop/5a501ec3ffe8b12df3bcc46f [@7ffb624] RUNNING
2020-11-19T18:34:26.084-06:00 INFO  [LookupDataAdapterRefreshService] Adding job for <spamhaus-drop/5a501ec3ffe8b12df3bcc46f/@7ffb624> [interval=43200000ms]
2020-11-19T18:34:26.691-06:00 INFO  [LookupTableService] Data Adapter tor-exit-node/5a501ec3ffe8b12df3bcc46c [@7eff159a] RUNNING
2020-11-19T18:34:26.692-06:00 INFO  [LookupDataAdapterRefreshService] Adding job for <tor-exit-node/5a501ec3ffe8b12df3bcc46c/@7eff159a> [interval=3600000ms]
2020-11-19T18:34:26.711-06:00 INFO  [LookupTableService] Starting lookup table otx-api-ip/5a501ec3ffe8b12df3bcc472 [@2536795d] using cache otx-api-ip-cache/5a501ec3ffe8b12df3bcc463 [@2a8e78be], data adapter otx-api-ip/5a501ec3ffe8b12df3bcc46a [@525b12fb]
2020-11-19T18:34:26.712-06:00 INFO  [LookupTableService] Starting lookup table whois/5a501ec3ffe8b12df3bcc473 [@7abbd962] using cache whois-cache/5a501ec3ffe8b12df3bcc465 [@75d0fb32], data adapter whois/5a501ec3ffe8b12df3bcc46d [@38659bc5]
2020-11-19T18:34:26.712-06:00 INFO  [LookupTableService] Starting lookup table abuse-ch-ransomware-domains/5a501ec3ffe8b12df3bcc474 [@265d9a22] using cache threat-intel-uncached-adapters/5a501ec3ffe8b12df3bcc462 [@769dd917], data adapter abuse-ch-ransomware-domains/5a501ec3ffe8b12df3bcc468 [@227e17de]
2020-11-19T18:34:26.712-06:00 INFO  [LookupTableService] Starting lookup table abuse-ch-ransomware-ip/5a501ec3ffe8b12df3bcc475 [@46252424] using cache threat-intel-uncached-adapters/5a501ec3ffe8b12df3bcc462 [@769dd917], data adapter abuse-ch-ransomware-ip/5a501ec3ffe8b12df3bcc469 [@1883eb08]
2020-11-19T18:34:26.712-06:00 INFO  [LookupTableService] Starting lookup table spamhaus-drop/5a501ec3ffe8b12df3bcc476 [@50cf512c] using cache spamhaus-e-drop-cache/5a501ec3ffe8b12df3bcc466 [@8e52510], data adapter spamhaus-drop/5a501ec3ffe8b12df3bcc46f [@7ffb624]
2020-11-19T18:34:26.713-06:00 INFO  [LookupTableService] Starting lookup table otx-api-domain/5a501ec3ffe8b12df3bcc477 [@741bf29e] using cache otx-api-domain-cache/5a501ec3ffe8b12df3bcc464 [@1492a11], data adapter otx-api-domain/5a501ec3ffe8b12df3bcc470 [@53de141f]
2020-11-19T18:34:26.713-06:00 INFO  [LookupTableService] Starting lookup table tor-exit-node-list/5a501ec3ffe8b12df3bcc478 [@3eddfab5] using cache threat-intel-uncached-adapters/5a501ec3ffe8b12df3bcc462 [@769dd917], data adapter tor-exit-node/5a501ec3ffe8b12df3bcc46c [@7eff159a]
2020-11-19T18:34:26.713-06:00 INFO  [LookupTableService] Starting lookup table geoip/5f28d53e654a4710e38da79c [@5136fd4e] using cache geoip/5f28d50c654a4710e38da6eb [@51f7e73a], data adapter geo-locator/5deb235a83d72ece8f020fa7 [@34928009]
2020-11-19T18:35:02.823-06:00 INFO  [NetworkListener] Started listener bound to [graylog.enseva-labs.net:9000]
2020-11-19T18:35:02.826-06:00 INFO  [HttpServer] [HttpServer] Started.
2020-11-19T18:35:02.827-06:00 INFO  [JerseyService] Started REST API at <graylog.enseva-labs.net:9000>
2020-11-19T18:35:02.827-06:00 INFO  [ServiceManagerListener] Services are healthy
2020-11-19T18:35:02.829-06:00 INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2020-11-19T18:35:02.830-06:00 INFO  [ServerBootstrap] Services started, startup times in ms: {InputSetupService [RUNNING]=5, UrlWhitelistService [RUNNING]=7, GracefulShutdownService [RUNNING]=10, JobSchedulerService [RUNNING]=10, JournalReader [RUNNING]=11, KafkaJournal [RUNNING]=14, OutputSetupService [RUNNING]=15, EtagService [RUNNING]=15, ConfigurationEtagService [RUNNING]=15, BufferSynchronizerService [RUNNING]=18, MongoDBProcessingStatusRecorderService [RUNNING]=54, StreamCacheService [RUNNING]=89, PeriodicalsService [RUNNING]=136, LookupTableService [RUNNING]=1920, JerseyService [RUNNING]=38042}
2020-11-19T18:35:02.837-06:00 INFO  [ServerBootstrap] Graylog server up and running.
2020-11-19T18:35:02.952-06:00 INFO  [AbstractTcpTransport] Enabled TLS for input [GELF TCP/5a62903bffe8b1e04bd2fe89]. key-file="/etc/graylog/graylog2-key.pem" cert-file="/etc/graylog/graylog2-certificate.pem"
2020-11-19T18:35:02.952-06:00 INFO  [InputStateListener] Input [GELF TCP/5a62903bffe8b1e04bd2fe89] is now STARTING
2020-11-19T18:35:02.953-06:00 INFO  [AbstractTcpTransport] Enabled TLS for input [GELF TCP/5e265ada83d72ec570ab5fe2]. key-file="/etc/graylog/graylog2-key.pem" cert-file="/etc/graylog/graylog2-certificate.pem"
2020-11-19T18:35:02.956-06:00 INFO  [InputStateListener] Input [Raw/Plaintext UDP/5a6965ef83d72e84ac7ca99b] is now STARTING
2020-11-19T18:35:02.960-06:00 INFO  [InputStateListener] Input [GELF TCP/5e265ada83d72ec570ab5fe2] is now STARTING
2020-11-19T18:35:02.962-06:00 INFO  [InputStateListener] Input [Syslog TCP/5f88d6647740e35badd74185] is now STARTING
2020-11-19T18:35:02.970-06:00 INFO  [InputStateListener] Input [Raw/Plaintext UDP/5e9f732383d72e05f668a26d] is now STARTING
2020-11-19T18:35:03.191-06:00 INFO  [InputStateListener] Input [Syslog TCP/5f88d6647740e35badd74185] is now RUNNING
2020-11-19T18:35:03.215-06:00 INFO  [InputStateListener] Input [Raw/Plaintext UDP/5e9f732383d72e05f668a26d] is now RUNNING
2020-11-19T18:35:03.220-06:00 INFO  [InputStateListener] Input [Raw/Plaintext UDP/5a6965ef83d72e84ac7ca99b] is now RUNNING
2020-11-19T18:35:03.232-06:00 WARN  [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogTCPInput{title=Linux: Pi, type=org.graylog2.inputs.syslog.tcp.SyslogTCPInput, nodeId=null} (channel [id: 0xad8f559d, L:/0:0:0:0:0:0:0:0%0:50440]) should be 1048576 but is 425984.
2020-11-19T18:35:03.295-06:00 WARN  [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input GELFTCPInput{title=Windows System Secure, type=org.graylog2.inputs.gelf.tcp.GELFTCPInput, nodeId=null} (channel [id: 0x4c3cd409, L:/0:0:0:0:0:0:0:0%0:51412]) should be 1048576 but is 425984.
2020-11-19T18:35:03.300-06:00 INFO  [InputStateListener] Input [GELF TCP/5a62903bffe8b1e04bd2fe89] is now RUNNING
2020-11-19T18:35:03.310-06:00 WARN  [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input GELFTCPInput{title=Linux Secure System, type=org.graylog2.inputs.gelf.tcp.GELFTCPInput, nodeId=null} (channel [id: 0xd343f05b, L:/0:0:0:0:0:0:0:0%0:51411]) should be 1048576 but is 425984.
2020-11-19T18:35:03.314-06:00 INFO  [InputStateListener] Input [GELF TCP/5e265ada83d72ec570ab5fe2] is now RUNNING

No error/s were found in MongDB or Elasticsearch.
I also tried Chrome in incognito, no joy.

Any suggestion or advice would be apperciated, thanks in advance.

djc · November 20, 2020, 3:35am

I experience the same on centOS 7 and posted earlier with no replies.

If you disable https in the graylog conf file, it will work. Leads me to believe it’s an issue with his chrome interprets the cert. Just strange that it works without issue in 3.3.8

gsmith · November 20, 2020, 4:17am

@djc
Thanks for chiming in.
Yeah, I didn’t have a problem with 3.3.8 either. Just after the upgrade I check all the logs on my graylog server, and everything was in Green.
I was leaving work, so I didn’t bother opening Web UI until the next day. Then this happened.

konrad · November 20, 2020, 8:17am

Hey @gsmith,

I do not know how you setup graylog right now. But it seems you have an SSL error. Chrome is a bit more stict about it nowadays. But you can see the other browsers have the error as well.

- Konrad

PS: I googled your SSL error and found an hint on creating the certificate: https://superuser.com/questions/1451895/err-ssl-key-usage-incompatible-solution/1466118

bernd · November 20, 2020, 9:41am

@gsmith In Graylog 4.0 we improved the detection of available TLS protocols. That means it’s now more likely that we use TLSv1.3 by default if the Java runtime version supports it. With TLSv1.3 enabled, some browsers like Chrome seem to be more strict about the keyUsage and extendedKeyUsage fields in certificates.

As mentioned in the link @konrad posted above, the correct way to fix this is to put the appropriate values into the key usage fields of your certificate.

A quick fix would be to disable the usage of TLSv1.3 in the Graylog server config. Keep in mind that TLSv1.2 is less secure than TLSv1.3, so we are not recommending that for production setups.

- #enabled_tls_protocols= TLSv1.2,TLSv1.3
+ enabled_tls_protocols= TLSv1.2

gsmith · November 20, 2020, 10:40pm

@konrad
Thanks for the reply, Your googling is superioror then mine, much apperciated.

@bernd @konrad
Thanks for the replies, I took both of your advices. When I set up our graylog server 4 years ago I created two different certs, one for the Web UI and one for the Input’s GELF/TCP TLS . Last night I created new cert (i.e. https://superuser.com/questions/1451895/err-ssl-key-usage-incompatible-solution/1466118) for testing and it worked. Since the Input certs are a few months old I didnt have a problem with them.

@bernd My plan is to correct my certs and add them to the key store instead of back track to a less secure protocol.

@konrad @bernd Thank you guys for the information much apperciated.

system · December 4, 2020, 10:40pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Unable to connect to Graylog Web Interface Graylog Central (peer support)	3	11379	November 16, 2018
This browser is a customized version of the great Swagger project Graylog Central (peer support)	4	444	October 3, 2022
Graylog Web unreachable after update to 4 Graylog Central (peer support)	14	2176	May 19, 2021
Graylog web interface problem! Graylog Central (peer support)	12	4820	February 19, 2019
Graylog stuck at "We are preparing Graylog for you..." Graylog Central (peer support)	7	66	August 28, 2024

Graylog v4.0 Web Interface

Related topics