Handle "System messages" in the "Overview" section

Graylog Central (peer support)
1

Problem:
The Graylog GUI shows two years history of “System Messages” (“System / Overview” → “Overview” → “System message” section.

My environment:

  • Ubuntu 20.04.4 LTS
  • Graylog-server 4.2.8
  • MongoDB 4.0.28
  • Elasticsearch 6.8.23

Steps done so far:
I reduced the “Indices & Index Sets” retention and did delete all, but the latest / Index Sets.
The Graylog GUI still lists all (2 years) “System messages”.

**

Graylog
Graylog1273×743 151 KB

**

  • Is it correct, that the “System messages” are stored in the MongoDB?
  • How can I delete the ?“System messages”?

Thanks and regards
Michael

2

Hello,

MongoDb hold metadata.

I believe its stored in elasticsearch in binary files, but I’m not 100% sure

3

@mma

I was looking into this, If you goto System/Node ->> API Browser.
Under System/Messages : Internal Graylog messages

You can see you System Messages.
Request URL

https://graylog.domain.com:9000/api/system/messages

Here is the Response header. Maybe you can do something with that.

{"Content-Encoding":"gzip","Content-Type":"application/json","Transfer-Encoding":"chunked","X-Graylog-Node-Id":"8e947fe4-fe2a-48a3-9f2c-786652326c9a","X-Runtime-Microseconds":"77031"}
1 Like
4

System messages are stored in Mongo DB in collection system_messages.
We already have an issue to make an improvement to this:

2 Likes
5

Thanks gsmith and pattrickmann,

@gsmith: I’m able to query the logs. When I got it right, there are more than 360.000 log entries.

@patrickmann: The git issue for improvement contains the “command” needed for my purpose, but some additional steps have been needed for me to take benefit:

Install mongosh
Start mongosh and select the graylog db:

mongosh
show dbs
use graylog

Enter the sequence to delete system messages older than one month:

db.getCollection('system_messages').deleteMany({
    "timestamp":{
            $lt: new Date(new Date().setMonth(new Date().getMonth()-1))
    }
})

Result:“{ acknowledged: true, deletedCount: 362963 }”

(The system messages older than one month have been deleted)

Afterwards, I did release unneeded disk space:

db.getCollectionNames().forEach(function(collectionName){
print('Compacting: '+collectionName);
db.runCommand({compact: collectionName});
});

Thanks for your fast and helpful support!

Michael

1 Like
6

@patrickmann

Good find :+1: This also had me puzzled.

7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.