Lookup Table Error after updating tot Graylog 4.3.13 (from 4.3.12)

1. Incident Decription:
After updating the following error occurs in the server.log:

ERROR [CSVFileDataAdapter] The specified file [/etc/graylog/lookup-table.csv] does not exist or is not writable. To resolve this error, edit the adapter [ip-addres-lookup] and specify a new path, or restore the file or access to it.

The file is configured and placed in /etc/graylog/lookup-table.csv

[root@montst graylog]# ll /etc/graylog/
-rw-r--r--  1 root root 274 Mar 23 15:32 lookup-table.csv
drwxr-xr-x. 2 root root 110 Nov 15 16:56 server

afbeelding

Testing of the lookup fails:
afbeelding

2. Describe your environment:

  • OS Information: Rocky Linux release 8.7 (Green Obsidian)

  • Package Version: Graylog 4.3.13+7f1d15d

3. What steps have you already taken to try and solve the problem?

Updated the information in graylog via edit/save and gave UGA write access to the file.

4. How can the community help?

Provide a solution that helps, the table is set-up as documented.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

Strange, after doing some edit safe actions on the lookuptable and data adapter the error seems to be solved. Less strange that after some testing it looks like adjusting write access to the file for UGA is the trick.

Logging entries below.

2023-03-23T15:52:50.441+01:00 INFO  [LookupTableService] Starting lookup table hostname-resolver/62a336f0acee1013cff10527 [@29882ae6] using cache local_memory_cache/62a336b1acee1013cff104e1 [@393d60f8], data adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@41c3a79c]
2023-03-23T15:52:50.441+01:00 INFO  [LookupTableService] Replaced previous lookup table hostname-resolver [@14baf44c]
2023-03-23T15:53:38.995+01:00 INFO  [LookupTableService] Data Adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@118b08c6] STARTING
2023-03-23T15:53:38.996+01:00 INFO  [LookupTableService] Data Adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@118b08c6] RUNNING
2023-03-23T15:53:38.997+01:00 INFO  [LookupDataAdapterRefreshService] Adding job for <ip-addres-lookup/62a334bdacee1013cff102c1/@118b08c6> [interval=60000ms]
2023-03-23T15:53:38.999+01:00 INFO  [LookupTableService] Starting lookup table hostname-resolver/62a336f0acee1013cff10527 [@442cbc3c] using cache local_memory_cache/62a336b1acee1013cff104e1 [@393d60f8], data adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@118b08c6]
2023-03-23T15:53:38.999+01:00 INFO  [LookupTableService] Replaced previous lookup table hostname-resolver [@29882ae6]
2023-03-23T15:53:39.001+01:00 INFO  [LookupDataAdapterRefreshService] Removing job for <ip-addres-lookup/62a334bdacee1013cff102c1/@41c3a79c>
2023-03-23T15:53:39.001+01:00 INFO  [LookupTableService] Data Adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@41c3a79c] STOPPING, was RUNNING
2023-03-23T15:53:39.002+01:00 INFO  [LookupTableService] Data Adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@41c3a79c] TERMINATED, was STOPPING
2023-03-23T16:00:47.423+01:00 INFO  [LookupTableService] Data Adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@33a399ac] STARTING
2023-03-23T16:00:47.425+01:00 INFO  [LookupDataAdapterRefreshService] Adding job for <ip-addres-lookup/62a334bdacee1013cff102c1/@33a399ac> [interval=60000ms]
2023-03-23T16:00:47.425+01:00 INFO  [LookupTableService] Data Adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@33a399ac] RUNNING
2023-03-23T16:00:47.425+01:00 INFO  [LookupTableService] Starting lookup table hostname-resolver/62a336f0acee1013cff10527 [@11cade47] using cache local_memory_cache/62a336b1acee1013cff104e1 [@393d60f8], data adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@33a399ac]
2023-03-23T16:00:47.425+01:00 INFO  [LookupTableService] Replaced previous lookup table hostname-resolver [@442cbc3c]
2023-03-23T16:00:47.426+01:00 INFO  [LookupTableService] Data Adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@118b08c6] STOPPING, was RUNNING
2023-03-23T16:00:47.426+01:00 INFO  [LookupDataAdapterRefreshService] Removing job for <ip-addres-lookup/62a334bdacee1013cff102c1/@118b08c6>
2023-03-23T16:00:47.426+01:00 INFO  [LookupTableService] Data Adapter ip-addres-lookup/62a334bdacee1013cff102c1 [@118b08c6] TERMINATED, was STOPPING
1 Like

Hey @Arie

Thanks for the feed back :+1:

1 Like

@Arie I have same this problem. Please tell me for fix this error.

Hi,

chmid a+w on your file should fix it.

Kind greetings,

Arie

1 Like

Hi All, this has been identified as a bug and a fix will be released for Graylog 4.3 and 5.0: #14670 broke deployments because lookup table CSV files must be writable now · Issue #14998 · Graylog2/graylog2-server · GitHub

2 Likes

Thank you for reply.
Today I try change chmod csv again to 666 Error log has stop.
When last week, I changed to 777 but error is appeared always.
Maybe because I setting DataAdaptor something wrong.

Did you restart the service?

Our file is in :/etc/graylog looking like this:

-rw-rw-rw- 1 root root 274 Mar 23 15:32 lookup-table.csv

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.