Issue with Sidecar on linux (used to work) after restart stopped

Graylog Central (peer support)
,
1

sidecar not communicating with graylog server and stuck as below

image
image1249×135 7.59 KB

● graylog-sidecar.service - Wrapper service for Graylog controlled collector
Loaded: loaded (/etc/systemd/system/graylog-sidecar.service; enabled; vendor preset: disabled)
Active: active (running) since Sun 2020-02-23 16:50:06 +03; 40min ago
Main PID: 26658 (graylog-sidecar)
CGroup: /system.slice/graylog-sidecar.service
└─26658 /usr/bin/graylog-sidecar

Feb 23 16:50:06 master-ngx systemd[1]: Started Wrapper service for Graylog controlled collector.
Feb 23 16:50:07 master-ngx graylog-sidecar[26658]: time=“2020-02-23T16:50:07+03:00” level=info msg=“Using node-id: ab34e13a-a8ce-423b-8c6c-0f633181f603”
Feb 23 16:50:07 master-ngx graylog-sidecar[26658]: time=“2020-02-23T16:50:07+03:00” level=info msg=“Starting signal distributor”

Note : Network is working fine ,I toke a dump and its not showing any messages from the sidecar.

2

he @t.arabiyat

what does the sidecar LOGFILE show? what does your Graylog sidecar configuration look like?

3

The Graylog Config is below :slight_smile:

image
image1897×671 53.7 KB

And The side car log file is below :

time=“2020-02-23T16:19:18+03:00” level=info msg=“Starting signal distributor”
time=“2020-02-23T16:24:19+03:00” level=info msg=“Stopping signal distributor”
time=“2020-02-23T16:24:19+03:00” level=info msg=“Starting signal distributor”
time=“2020-02-23T16:24:32+03:00” level=info msg=“Stopping signal distributor”
time=“2020-02-23T16:24:41+03:00” level=info msg=“Starting signal distributor”
time=“2020-02-23T16:24:53+03:00” level=info msg=“Stopping signal distributor”
time=“2020-02-23T16:24:53+03:00” level=info msg=“Starting signal distributor”
time=“2020-02-23T16:33:43+03:00” level=info msg=“Stopping signal distributor”
time=“2020-02-23T16:33:43+03:00” level=info msg=“Starting signal distributor”
time=“2020-02-23T16:33:47+03:00” level=info msg=“Stopping signal distributor”
time=“2020-02-23T16:33:47+03:00” level=info msg=“Starting signal distributor”
time=“2020-02-23T16:38:56+03:00” level=info msg=“Stopping signal distributor”
time=“2020-02-23T16:39:08+03:00” level=info msg=“Starting signal distributor”
time=“2020-02-23T16:40:46+03:00” level=info msg=“Stopping signal distributor”
time=“2020-02-23T16:50:07+03:00” level=info msg=“Starting signal distributor”
[root@master-ngx graylog-sidecar]#

Appreciate the help.

4

Did you have issues with the sidecar or with the collector?

For me the current situation is not clear. You have two components - one is the sidecar, that is the agent that connects from the server you want to have logfiles from to Graylog. This will then get the configuration from Graylog and start the collector. That is the process that collects the logs and send it to Graylog.

Where you are having issues with?

5

The issue is with sidecar client not sending info to graylog server and not importing the config from graylog server and thus not starting the collector (filebeat) its stuck a the message :
time=“2020-02-23T16:50:07+03:00” level=info msg=“Starting signal distributor”

I tried reinstalling the sidecar client with no luck.
Note it used to work fine but after the restart of graylog server due to update to 3.2.2 it stopped So I rolled back to 3.2.1 and still not working.

Appreciate your help.

6

he @t.arabiyat
did you checked if the server_uri in the sidecar configration is unchanged? Did you checked if the server token is placed in the configuration file?

Did you checked of the server where the sidecar is running can reach Graylogs API?

7

Hello Jan,

Yes I did check all that and all of them checked out.

8

when all is status green the sidecar should be seen in the overview in the Graylog UI. If that is not the case - something is not working as it should and is not green.

9

As you can see below they are showing status of “Unkown” even thought the clients are running and the graylog server is reachable.

And I have other windows servers working fine and these Linux servers used to work fine with same config.

Check this screenshot.

image
image1858×246 40 KB

10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.