Inputs not Running(But still getting data in),, Node unavailable "Error Getting Data?"

Graylog Central (peer support)
1

2 Issues
Issue 1 - All inputs showing stopped.
Input 1 is Std Encrypted Linux
Input 2 is Syslog UDP

-When I click to start inputs, get an error message “Request to start input has failed”

–Although all inputs showing stopped, data is still coming in as normal, data is getting parsed and indexed as normal

Issue 2- Node information not available.

During normal operation, I can click the node and it redirects to a web page showing an overview of the node.

Currently , when I click on the node i get an error page (Monkey with Banana), which says
“Error Getting Data”. Followed by a red banner at the bottom saying
“Getting JVM information for Node xxxx , Error getting information”

Version Info
Graylog v4.2.7+879e651
Mongo 4.0.28
Elasticsearch is 7.16.2

Graylog, Elasticsearch,and Mongo all sitting on same server. No changes have been made recently to any internal configuration.

Checked Mongo, Graylog and Elasticsearch logs, nothing there. Only log to show anything is the Journal D Daemon which showed these errors

graylog-server[155044]: SLF4J: Failed to load class “org.slf4j.impl.StaticLoggerBinder”.
graylog-server[155044]: SLF4J: Defaulting to no-operation (NOP) logger implementation
graylog-server[155044]: SLF4J: See SLF4J Error Codes for further details.

Went to the link above, which states that Im getting this error due to the following

This warning message is reported when the org.slf4j.impl.StaticLoggerBinder class could not be loaded into memory. This happens when no appropriate SLF4J binding could be found on the class path.

So I changed my CLASSPATH to be directed at where I have my graylog.jar file
export CLASSPATH=/usr/share/something/something/graylog.jar

Besides this , have rebooted system about a dozen times as well as verifying my config file which hasn’t changed.

Also., This isn’t a new install, system has been up and running for approx 1 year.

2

Hello && Welcome @shart

Last time I see these logs were on Docker. If so we would nee to see those configuration also

Example of mine.

2022-03-28 23:39:57,588 INFO : org.graylog2.inputs.InputStateListener - Input [Syslog UDP/62314dedc73066466fe693e0] is now RUNNING
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
2022-03-28 23:40:36,105 INFO : org.graylog2.system.jobs.SystemJobManager - Submitted SystemJob <6048b170-af1a-11ec-a647-0242ac110004> [org.graylog.plugins.report.scheduler.ReportRenderSystemJob]

If you could show you environment configuration I probably could give you a direct answer to why this is issue is occurring.

Or you can look here

3

Of note: The latest supported version of Elasticsearch is 7.10.2. It is likely not related to this issue but keep an eye on that as Graylog will be supporting Opensearch in the future…

1 Like
4

Im not sure what you mean when you say Environment Configuration

5

Good catch :+1: I am going blind :laughing:

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.