GUI not coming up

deepaksharma171191 · March 11, 2019, 9:25am

Hi Team,
I had setup the new graylog as per link http://docs.graylog.org/en/3.0/pages/installation/os/centos.html, but I am not getting grayloy console coming up in browser. And graylog service is automatically getting down even after following the steps mentioned in line, seeing below error in graylog-server/server.log

sudo systemctl status graylog-server
[sudo] password for sharmad:
● graylog-server.service - Graylog server
Loaded: loaded (/usr/lib/systemd/system/graylog-server.service; enabled; vendor preset: disabled)
Active: activating (auto-restart) (Result: exit-code) since Mon 2019-03-11 09:14:06 GMT; 7s ago
Docs: http://docs.graylog.org/
Process: 18028 ExecStart=/usr/share/graylog-server/bin/graylog-server (code=exited, status=1/FAILURE)
Main PID: 18028 (code=exited, status=1/FAILURE)

Mar 11 09:14:06 lit-vatam-t005 systemd[1]: graylog-server.service: main process exited, code=exited, status=1/FAILURE
Mar 11 09:14:06 lit-vatam-t005 systemd[1]: Unit graylog-server.service entered failed state.
Mar 11 09:14:06 lit-vatam-t005 systemd[1]: graylog-server.service failed.

graylog-server/server.log -->

2019-03-11T09:17:38.169Z ERROR [CmdLineTool] Invalid configuration
com.github.joschi.jadconfig.ValidationException: Couldn’t run validator method
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:227) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.process(JadConfig.java:100) ~[graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:351) [graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:344) [graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:178) [graylog.jar:?]
at org.graylog2.bootstrap.Main.main(Main.java:50) [graylog.jar:?]
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_201]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_201]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_201]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_201]
at com.github.joschi.jadconfig.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:53) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:221) ~[graylog.jar:?]
… 5 more
Caused by: java.lang.RuntimeException: Could not parse URI.
at org.graylog2.plugin.Tools.getUriWithScheme(Tools.java:541) ~[graylog.jar:?]
at org.graylog2.plugin.Tools.lambda$normalizeURI$0(Tools.java:593) ~[graylog.jar:?]
at java.util.Optional.map(Optional.java:215) ~[?:1.8.0_201]
at org.graylog2.plugin.Tools.normalizeURI(Tools.java:593) ~[graylog.jar:?]
at org.graylog2.configuration.HttpConfiguration.getHttpPublishUri(HttpConfiguration.java:118) ~[graylog.jar:?]
at org.graylog2.configuration.HttpConfiguration.validateHttpPublishUriPathEndsWithSlash(HttpConfiguration.java:234) ~[graylog.jar:?]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_201]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_201]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_201]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_201]
at com.github.joschi.jadconfig.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:53) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:221) ~[graylog.jar:?]
… 5 more
Caused by: java.net.URISyntaxException: Expected scheme-specific part at index 5: http:
at java.net.URI$Parser.fail(URI.java:2848) ~[?:1.8.0_201]
at java.net.URI$Parser.failExpecting(URI.java:2854) ~[?:1.8.0_201]
at java.net.URI$Parser.parse(URI.java:3057) ~[?:1.8.0_201]
at java.net.URI.(URI.java:673) ~[?:1.8.0_201]
at org.graylog2.plugin.Tools.getUriWithScheme(Tools.java:539) ~[graylog.jar:?]
at org.graylog2.plugin.Tools.lambda$normalizeURI$0(Tools.java:593) ~[graylog.jar:?]
at java.util.Optional.map(Optional.java:215) ~[?:1.8.0_201]
at org.graylog2.plugin.Tools.normalizeURI(Tools.java:593) ~[graylog.jar:?]
at org.graylog2.configuration.HttpConfiguration.getHttpPublishUri(HttpConfiguration.java:118) ~[graylog.jar:?]
at org.graylog2.configuration.HttpConfiguration.validateHttpPublishUriPathEndsWithSlash(HttpConfiguration.java:234) ~[graylog.jar:?]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_201]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_201]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_201]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_201]
at com.github.joschi.jadconfig.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:53) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:221) ~[graylog.jar:?]
… 5 more

jan · March 11, 2019, 10:24am

First it is always helpful to format you posting in a way that makes other help to read your postings. LIke mentioned here: FAQ - Graylog Community

In addition reading the log messages and try to find meaningful parts always helps.

2019-03-11T09:17:38.169Z ERROR [CmdLineTool] Invalid configuration
com.github.joschi.jadconfig.ValidationException: Couldn’t run validator method

It looks like something in your configuration is not right …

later I see:

Caused by: java.net.URISyntaxException: Expected scheme-specific part at index 5: http:

you should check your http_* settings, read the documentation of them and what is expected.

deepaksharma171191 · March 25, 2019, 7:21am

Hi Jan,

Here the below settings and I am seeing a blank screen in browser. Kindly look into below config and log file output.

cat /etc/graylog/server/server.conf | grep -v '#' | grep -v '^$'
is_master = true
node_id_file = /etc/graylog/server/node-id
password_secret = <used-as-per-doc>
root_username = admin
root_password_sha2 = <used-as-per-doc>
bin_dir = /usr/share/graylog-server/bin
data_dir = /var/lib/graylog-server
plugin_dir = /usr/share/graylog-server/plugin
http_bind_address = <server-ip>:9000
http_publish_uri = http://$http_bind_address/
http_external_uri = $http_publish_uri/
http_enable_cors = true
http_max_header_size = 8192
http_thread_pool_size = 16
http_enable_tls = false
elasticsearch_hosts = http://<server-ip>:9200
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false
allow_highlighting = false
elasticsearch_analyzer = standard
output_batch_size = 500
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://localhost/graylog
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
proxied_requests_thread_pool_size = 32

cat /etc/elasticsearch/elasticsearch.yml | grep -v '#' | grep -v '^$'
cluster.name: graylog
action.auto_create_index: false
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: <server-ip>

tail -f /var/log/graylog-server/server.log

2019-03-25T07:18:27.106Z INFO  [Periodicals] Starting [org.graylog2.periodical.IndexFailuresPeriodical] periodical, running forever.
2019-03-25T07:18:27.110Z INFO  [Periodicals] Starting [org.graylog2.periodical.TrafficCounterCalculator] periodical in [0s], polling every [1s].
2019-03-25T07:18:27.152Z INFO  [Periodicals] Starting [org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical] periodical in [0s], polling every [3600s].
2019-03-25T07:18:27.154Z INFO  [IndexFieldTypePollerPeriodical] Cluster not connected yet, delaying index field type initialization until it is reachable.
2019-03-25T07:18:27.156Z INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredSidecarsThread] periodical in [0s], polling every [600s].
2019-03-25T07:18:27.158Z INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredConfigurationUploads] periodical in [0s], polling every [600s].
2019-03-25T07:18:27.159Z INFO  [Periodicals] Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2019-03-25T07:18:27.277Z INFO  [V20161130141500_DefaultStreamRecalcIndexRanges] Cluster not connected yet, delaying migration until it is reachable.
2019-03-25T07:18:27.305Z INFO  [JerseyService] Enabling CORS for HTTP endpoint
2019-03-25T07:18:41.926Z INFO  [IndexRangesCleanupPeriodical] Skipping index range cleanup because the Elasticsearch cluster is unreachable or unhealthy
2019-03-25T07:18:44.268Z INFO  [NetworkListener] Started listener bound to [<server-ip>:9000]
2019-03-25T07:18:44.270Z INFO  [HttpServer] [HttpServer] Started.
2019-03-25T07:18:44.270Z INFO  [JerseyService] Started REST API at <<server-ip>:9000>
2019-03-25T07:18:44.270Z INFO  [ServiceManagerListener] Services are healthy
2019-03-25T07:18:44.271Z INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2019-03-25T07:18:44.271Z INFO  [ServerBootstrap] Services started, startup times in ms: {OutputSetupService [RUNNING]=24, BufferSynchronizerService [RUNNING]=24, KafkaJournal [RUNNING]=29, InputSetupService [RUNNING]=41, ConfigurationEtagService [RUNNING]=116, EtagService [RUNNING]=116, JournalReader [RUNNING]=116, StreamCacheService [RUNNING]=248, LookupTableService [RUNNING]=301, PeriodicalsService [RUNNING]=302, JerseyService [RUNNING]=17404}
2019-03-25T07:18:44.278Z INFO  [ServerBootstrap] Graylog server up and running.
^C
[root@lit-vatam-t005 ~]# view /var/log/graylog-server/server.log
2019-03-25T07:18:27.106Z INFO  [Periodicals] Starting [org.graylog2.periodical.IndexFailuresPeriodical] periodical, running forever.
2019-03-25T07:18:27.110Z INFO  [Periodicals] Starting [org.graylog2.periodical.TrafficCounterCalculator] periodical in [0s], polling every [1s].
2019-03-25T07:18:27.152Z INFO  [Periodicals] Starting [org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical] periodical in [0s], polling every [3600s].
2019-03-25T07:18:27.154Z INFO  [IndexFieldTypePollerPeriodical] Cluster not connected yet, delaying index field type initialization until it is reachable.
2019-03-25T07:18:27.156Z INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredSidecarsThread] periodical in [0s], polling every [600s].
2019-03-25T07:18:27.158Z INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredConfigurationUploads] periodical in [0s], polling every [600s].
2019-03-25T07:18:27.159Z INFO  [Periodicals] Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2019-03-25T07:18:27.277Z INFO  [V20161130141500_DefaultStreamRecalcIndexRanges] Cluster not connected yet, delaying migration until it is reachable.
2019-03-25T07:18:27.305Z INFO  [JerseyService] Enabling CORS for HTTP endpoint
2019-03-25T07:18:41.926Z INFO  [IndexRangesCleanupPeriodical] Skipping index range cleanup because the Elasticsearch cluster is unreachable or unhealthy
2019-03-25T07:18:44.268Z INFO  [NetworkListener] Started listener bound to [<server-ip>:9000]
2019-03-25T07:18:44.270Z INFO  [HttpServer] [HttpServer] Started.
2019-03-25T07:18:44.270Z INFO  [JerseyService] Started REST API at <<server-ip>:9000>
2019-03-25T07:18:44.270Z INFO  [ServiceManagerListener] Services are healthy
2019-03-25T07:18:44.271Z INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2019-03-25T07:18:44.271Z INFO  [ServerBootstrap] Services started, startup times in ms: {OutputSetupService [RUNNING]=24, BufferSynchronizerService [RUNNING]=24, KafkaJournal [RUNNING]=29, InputSetupService [RUNNING]=41, ConfigurationEtagService [RUNNING]=116, EtagService [RUNNING]=116, JournalReader [RUNNING]=116, StreamCacheService [RUNNING]=248, LookupTableService [RUNNING]=301, PeriodicalsService [RUNNING]=302, JerseyService [RUNNING]=17404}
2019-03-25T07:18:44.278Z INFO  [ServerBootstrap] Graylog server up and running.
2019-03-25T07:18:56.909Z ERROR [Cluster] Couldn't read cluster health for indices [graylog_*] (Could not connect to http://10.132.244.105:9200)
2019-03-25T07:18:56.909Z INFO  [IndexerClusterCheckerThread] Indexer not fully initialized yet. Skipping periodic cluster check.

 yum info graylog-server
Loaded plugins: langpacks, product-id, rhnplugin, search-disabled-repos, subscription-manager
This system is receiving updates from RHN Classic or Red Hat Satellite.
Installed Packages
Name        : graylog-server
Arch        : noarch
Version     : 3.0.0
Release     : 12
Size        : 117 M
Repo        : installed
From repo   : graylog
Summary     : Graylog server
URL         : https://www.graylog.org/
License     : GPLv3
Description : Graylog server

cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.6 (Maipo)

jan · March 25, 2019, 7:30am

are you able to access <server-ip>:9000 from your desktop and is your browser able to reach that?

deepaksharma171191 · March 25, 2019, 8:41am

Hi Jan,

I am getting a blank page (attached snapshot)

jan · March 25, 2019, 9:43am

what is the output when you try to use curl to connect that page?

deepaksharma171191 · March 25, 2019, 11:04am

Here it is, kindly let me know if you wanna see output of any specific command

curl http://<server-ip>:9000/
<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="robots" content="noindex, nofollow">
    <meta charset="UTF-8">
    <title>Graylog Web Interface</title>
    <link rel="shortcut icon" href="$http_publish_uri/assets/favicon.png">

  </head>
  <body>
    <script src="$http_publish_uri/config.js"></script>

    <script src="$http_publish_uri/assets/vendor.4024e2a8db732781a971.js"></script>

    <script src="$http_publish_uri/assets/polyfill.567b98aaba093175141f.js"></script>

    <script src="$http_publish_uri/assets/builtins.567b98aaba093175141f.js"></script>

    <script src="$http_publish_uri/assets/plugin/org.graylog.plugins.threatintel.ThreatIntelPlugin/plugin.org.graylog.plugins.threatintel.ThreatIntelPlugin.2f242956705001cd058c.js"></script>

    <script src="$http_publish_uri/assets/plugin/org.graylog.plugins.collector.CollectorPlugin/plugin.org.graylog.plugins.collector.CollectorPlugin.8ad21418ad38b4d44bb7.js"></script>

    <script src="$http_publish_uri/assets/plugin/org.graylog.aws.AWSPlugin/plugin.org.graylog.aws.AWSPlugin.5485f767f3c63b51dbf4.js"></script>

    <script src="$http_publish_uri/assets/app.567b98aaba093175141f.js"></script>

  </body>
</html>

macko003 · March 25, 2019, 3:04pm

try to comment these lines in your config

http_publish_uri = http://$http_bind_address/
http_external_uri = $http_publish_uri/

As far as I see these are not the default values.

system · April 8, 2019, 3:18pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Unable to run graylog-server Graylog Central (peer support)	2	2247	February 14, 2021
Problem when installing graylog Graylog Central (peer support)	6	677	August 8, 2021
Graylog isnt working Graylog Central (peer support)	2	3470	March 8, 2019
I can't run graylog Graylog Central (peer support) access-specific-log-	1	31	July 26, 2024
Graylog web interface Graylog Central (peer support)	3	1333	August 8, 2017

GUI not coming up

Related topics