Incoming logs no longer processed

[guyg1971]

Hello to all.

I am quite new to Graylog, even if my server has been running for some time now.

So I am running Graylog 6.3.4-1 on an Ubuntu 22 LTS, and I was running low on disk space (under 10%, on a 100GB disk). I added some more disk space, and apparently you need to do some web requests to unlock.

I’ve been trying a few that I found on the Internet, however without success.

So what can I do to treat the missing logs in Graylog, so that my streams are working again.

Thanks a lot

[Wine_Merchant]

Hey @guyg1971,

It seems like the journal might be corrupt, stop the Graylog service and delete the contents of the journal directory sudo rm -R /var/lib/graylog-server/journal/* then restart the Graylog service.

Full disclosure that this will lead to lost data as it seems there are still logs contained within your journal which by enacting the above will be deleted.

[guyg1971]

Hi.

ok so far so good, the logs are treated again.

Is there a way to reimport the missing logs from that corrupt journal ?

Actually I renamed the journal folder, so I still have the old ones.

Thanks a lot

[Wine_Merchant]

Unfortunately there is no nice way to achieve this, the logs themselves might be listed within the .log file contained within the journal folder but replaying those back into a Graylog input would be tricky.

As much as I dislike saying it, a conversation with a certain gpt might supply a route forward.