GUI not coming up

Hi Team,
I had setup the new graylog as per link http://docs.graylog.org/en/3.0/pages/installation/os/centos.html, but I am not getting grayloy console coming up in browser. And graylog service is automatically getting down even after following the steps mentioned in line, seeing below error in graylog-server/server.log

sudo systemctl status graylog-server
[sudo] password for sharmad:
● graylog-server.service - Graylog server
Loaded: loaded (/usr/lib/systemd/system/graylog-server.service; enabled; vendor preset: disabled)
Active: activating (auto-restart) (Result: exit-code) since Mon 2019-03-11 09:14:06 GMT; 7s ago
Docs: http://docs.graylog.org/
Process: 18028 ExecStart=/usr/share/graylog-server/bin/graylog-server (code=exited, status=1/FAILURE)
Main PID: 18028 (code=exited, status=1/FAILURE)

Mar 11 09:14:06 lit-vatam-t005 systemd[1]: graylog-server.service: main process exited, code=exited, status=1/FAILURE
Mar 11 09:14:06 lit-vatam-t005 systemd[1]: Unit graylog-server.service entered failed state.
Mar 11 09:14:06 lit-vatam-t005 systemd[1]: graylog-server.service failed.

graylog-server/server.log -->

2019-03-11T09:17:38.169Z ERROR [CmdLineTool] Invalid configuration
com.github.joschi.jadconfig.ValidationException: Couldn’t run validator method
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:227) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.process(JadConfig.java:100) ~[graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:351) [graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:344) [graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:178) [graylog.jar:?]
at org.graylog2.bootstrap.Main.main(Main.java:50) [graylog.jar:?]
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_201]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_201]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_201]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_201]
at com.github.joschi.jadconfig.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:53) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:221) ~[graylog.jar:?]
… 5 more
Caused by: java.lang.RuntimeException: Could not parse URI.
at org.graylog2.plugin.Tools.getUriWithScheme(Tools.java:541) ~[graylog.jar:?]
at org.graylog2.plugin.Tools.lambda$normalizeURI$0(Tools.java:593) ~[graylog.jar:?]
at java.util.Optional.map(Optional.java:215) ~[?:1.8.0_201]
at org.graylog2.plugin.Tools.normalizeURI(Tools.java:593) ~[graylog.jar:?]
at org.graylog2.configuration.HttpConfiguration.getHttpPublishUri(HttpConfiguration.java:118) ~[graylog.jar:?]
at org.graylog2.configuration.HttpConfiguration.validateHttpPublishUriPathEndsWithSlash(HttpConfiguration.java:234) ~[graylog.jar:?]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_201]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_201]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_201]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_201]
at com.github.joschi.jadconfig.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:53) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:221) ~[graylog.jar:?]
… 5 more
Caused by: java.net.URISyntaxException: Expected scheme-specific part at index 5: http:
at java.net.URI$Parser.fail(URI.java:2848) ~[?:1.8.0_201]
at java.net.URI$Parser.failExpecting(URI.java:2854) ~[?:1.8.0_201]
at java.net.URI$Parser.parse(URI.java:3057) ~[?:1.8.0_201]
at java.net.URI.(URI.java:673) ~[?:1.8.0_201]
at org.graylog2.plugin.Tools.getUriWithScheme(Tools.java:539) ~[graylog.jar:?]
at org.graylog2.plugin.Tools.lambda$normalizeURI$0(Tools.java:593) ~[graylog.jar:?]
at java.util.Optional.map(Optional.java:215) ~[?:1.8.0_201]
at org.graylog2.plugin.Tools.normalizeURI(Tools.java:593) ~[graylog.jar:?]
at org.graylog2.configuration.HttpConfiguration.getHttpPublishUri(HttpConfiguration.java:118) ~[graylog.jar:?]
at org.graylog2.configuration.HttpConfiguration.validateHttpPublishUriPathEndsWithSlash(HttpConfiguration.java:234) ~[graylog.jar:?]
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_201]
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_201]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_201]
at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_201]
at com.github.joschi.jadconfig.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:53) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:221) ~[graylog.jar:?]
… 5 more

First it is always helpful to format you posting in a way that makes other help to read your postings. LIke mentioned here: https://community.graylog.org/faq#format-markdown

In addition reading the log messages and try to find meaningful parts always helps.

2019-03-11T09:17:38.169Z ERROR [CmdLineTool] Invalid configuration
com.github.joschi.jadconfig.ValidationException: Couldn’t run validator method

It looks like something in your configuration is not right …

later I see:

Caused by: java.net.URISyntaxException: Expected scheme-specific part at index 5: http:

you should check your http_* settings, read the documentation of them and what is expected.

Hi Jan,

Here the below settings and I am seeing a blank screen in browser. Kindly look into below config and log file output.

cat /etc/graylog/server/server.conf | grep -v '#' | grep -v '^$'
is_master = true
node_id_file = /etc/graylog/server/node-id
password_secret = <used-as-per-doc>
root_username = admin
root_password_sha2 = <used-as-per-doc>
bin_dir = /usr/share/graylog-server/bin
data_dir = /var/lib/graylog-server
plugin_dir = /usr/share/graylog-server/plugin
http_bind_address = <server-ip>:9000
http_publish_uri = http://$http_bind_address/
http_external_uri = $http_publish_uri/
http_enable_cors = true
http_max_header_size = 8192
http_thread_pool_size = 16
http_enable_tls = false
elasticsearch_hosts = http://<server-ip>:9200
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false
allow_highlighting = false
elasticsearch_analyzer = standard
output_batch_size = 500
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://localhost/graylog
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
proxied_requests_thread_pool_size = 32

cat /etc/elasticsearch/elasticsearch.yml | grep -v '#' | grep -v '^$'
cluster.name: graylog
action.auto_create_index: false
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: <server-ip>
tail -f /var/log/graylog-server/server.log

2019-03-25T07:18:27.106Z INFO  [Periodicals] Starting [org.graylog2.periodical.IndexFailuresPeriodical] periodical, running forever.
2019-03-25T07:18:27.110Z INFO  [Periodicals] Starting [org.graylog2.periodical.TrafficCounterCalculator] periodical in [0s], polling every [1s].
2019-03-25T07:18:27.152Z INFO  [Periodicals] Starting [org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical] periodical in [0s], polling every [3600s].
2019-03-25T07:18:27.154Z INFO  [IndexFieldTypePollerPeriodical] Cluster not connected yet, delaying index field type initialization until it is reachable.
2019-03-25T07:18:27.156Z INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredSidecarsThread] periodical in [0s], polling every [600s].
2019-03-25T07:18:27.158Z INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredConfigurationUploads] periodical in [0s], polling every [600s].
2019-03-25T07:18:27.159Z INFO  [Periodicals] Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2019-03-25T07:18:27.277Z INFO  [V20161130141500_DefaultStreamRecalcIndexRanges] Cluster not connected yet, delaying migration until it is reachable.
2019-03-25T07:18:27.305Z INFO  [JerseyService] Enabling CORS for HTTP endpoint
2019-03-25T07:18:41.926Z INFO  [IndexRangesCleanupPeriodical] Skipping index range cleanup because the Elasticsearch cluster is unreachable or unhealthy
2019-03-25T07:18:44.268Z INFO  [NetworkListener] Started listener bound to [<server-ip>:9000]
2019-03-25T07:18:44.270Z INFO  [HttpServer] [HttpServer] Started.
2019-03-25T07:18:44.270Z INFO  [JerseyService] Started REST API at <<server-ip>:9000>
2019-03-25T07:18:44.270Z INFO  [ServiceManagerListener] Services are healthy
2019-03-25T07:18:44.271Z INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2019-03-25T07:18:44.271Z INFO  [ServerBootstrap] Services started, startup times in ms: {OutputSetupService [RUNNING]=24, BufferSynchronizerService [RUNNING]=24, KafkaJournal [RUNNING]=29, InputSetupService [RUNNING]=41, ConfigurationEtagService [RUNNING]=116, EtagService [RUNNING]=116, JournalReader [RUNNING]=116, StreamCacheService [RUNNING]=248, LookupTableService [RUNNING]=301, PeriodicalsService [RUNNING]=302, JerseyService [RUNNING]=17404}
2019-03-25T07:18:44.278Z INFO  [ServerBootstrap] Graylog server up and running.
^C
[root@lit-vatam-t005 ~]# view /var/log/graylog-server/server.log
2019-03-25T07:18:27.106Z INFO  [Periodicals] Starting [org.graylog2.periodical.IndexFailuresPeriodical] periodical, running forever.
2019-03-25T07:18:27.110Z INFO  [Periodicals] Starting [org.graylog2.periodical.TrafficCounterCalculator] periodical in [0s], polling every [1s].
2019-03-25T07:18:27.152Z INFO  [Periodicals] Starting [org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical] periodical in [0s], polling every [3600s].
2019-03-25T07:18:27.154Z INFO  [IndexFieldTypePollerPeriodical] Cluster not connected yet, delaying index field type initialization until it is reachable.
2019-03-25T07:18:27.156Z INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredSidecarsThread] periodical in [0s], polling every [600s].
2019-03-25T07:18:27.158Z INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredConfigurationUploads] periodical in [0s], polling every [600s].
2019-03-25T07:18:27.159Z INFO  [Periodicals] Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2019-03-25T07:18:27.277Z INFO  [V20161130141500_DefaultStreamRecalcIndexRanges] Cluster not connected yet, delaying migration until it is reachable.
2019-03-25T07:18:27.305Z INFO  [JerseyService] Enabling CORS for HTTP endpoint
2019-03-25T07:18:41.926Z INFO  [IndexRangesCleanupPeriodical] Skipping index range cleanup because the Elasticsearch cluster is unreachable or unhealthy
2019-03-25T07:18:44.268Z INFO  [NetworkListener] Started listener bound to [<server-ip>:9000]
2019-03-25T07:18:44.270Z INFO  [HttpServer] [HttpServer] Started.
2019-03-25T07:18:44.270Z INFO  [JerseyService] Started REST API at <<server-ip>:9000>
2019-03-25T07:18:44.270Z INFO  [ServiceManagerListener] Services are healthy
2019-03-25T07:18:44.271Z INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2019-03-25T07:18:44.271Z INFO  [ServerBootstrap] Services started, startup times in ms: {OutputSetupService [RUNNING]=24, BufferSynchronizerService [RUNNING]=24, KafkaJournal [RUNNING]=29, InputSetupService [RUNNING]=41, ConfigurationEtagService [RUNNING]=116, EtagService [RUNNING]=116, JournalReader [RUNNING]=116, StreamCacheService [RUNNING]=248, LookupTableService [RUNNING]=301, PeriodicalsService [RUNNING]=302, JerseyService [RUNNING]=17404}
2019-03-25T07:18:44.278Z INFO  [ServerBootstrap] Graylog server up and running.
2019-03-25T07:18:56.909Z ERROR [Cluster] Couldn't read cluster health for indices [graylog_*] (Could not connect to http://10.132.244.105:9200)
2019-03-25T07:18:56.909Z INFO  [IndexerClusterCheckerThread] Indexer not fully initialized yet. Skipping periodic cluster check.
 yum info graylog-server
Loaded plugins: langpacks, product-id, rhnplugin, search-disabled-repos, subscription-manager
This system is receiving updates from RHN Classic or Red Hat Satellite.
Installed Packages
Name        : graylog-server
Arch        : noarch
Version     : 3.0.0
Release     : 12
Size        : 117 M
Repo        : installed
From repo   : graylog
Summary     : Graylog server
URL         : https://www.graylog.org/
License     : GPLv3
Description : Graylog server
cat /etc/redhat-release
Red Hat Enterprise Linux Server release 7.6 (Maipo)

are you able to access <server-ip>:9000 from your desktop and is your browser able to reach that?

Hi Jan,

I am getting a blank page (attached snapshot)

what is the output when you try to use curl to connect that page?

Here it is, kindly let me know if you wanna see output of any specific command

curl http://<server-ip>:9000/
<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="robots" content="noindex, nofollow">
    <meta charset="UTF-8">
    <title>Graylog Web Interface</title>
    <link rel="shortcut icon" href="$http_publish_uri/assets/favicon.png">

  </head>
  <body>
    <script src="$http_publish_uri/config.js"></script>

    <script src="$http_publish_uri/assets/vendor.4024e2a8db732781a971.js"></script>

    <script src="$http_publish_uri/assets/polyfill.567b98aaba093175141f.js"></script>

    <script src="$http_publish_uri/assets/builtins.567b98aaba093175141f.js"></script>

    <script src="$http_publish_uri/assets/plugin/org.graylog.plugins.threatintel.ThreatIntelPlugin/plugin.org.graylog.plugins.threatintel.ThreatIntelPlugin.2f242956705001cd058c.js"></script>

    <script src="$http_publish_uri/assets/plugin/org.graylog.plugins.collector.CollectorPlugin/plugin.org.graylog.plugins.collector.CollectorPlugin.8ad21418ad38b4d44bb7.js"></script>

    <script src="$http_publish_uri/assets/plugin/org.graylog.aws.AWSPlugin/plugin.org.graylog.aws.AWSPlugin.5485f767f3c63b51dbf4.js"></script>

    <script src="$http_publish_uri/assets/app.567b98aaba093175141f.js"></script>

  </body>
</html>

try to comment these lines in your config

http_publish_uri = http://$http_bind_address/
http_external_uri = $http_publish_uri/

As far as I see these are not the default values.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.