@RCR I’m new to Graylog but hopefully I can be of some help. Based on looking at the EventProcessorEventFactory.java code the node ID is being retrieved by first retrieving the hostname of the node from the Graylog configuration. Unfortunately, there isn’t sufficient granularity in the code to determine if the hostname retrieval is the part that is failing or if it’s still something related to the node ID lookup using the hostname. So we have to tackle one at a time to see what we find. I don’t think this is a connection issue from node to node because there isn’t any indication that communication is attempting to occur over the network. This seems to be an issue with the configuration in the database.
Can you provide the contents of your /etc/graylog/server/node-id files for review? The UUID in the file for each node should match the corresponding UUID in the Mongo database.
Additionally, the hostnames are set in Graylog when the nodes are registered.
To confirm the hostnames and UUIDs are correct you can connect to the Mongo db.
Run ‘mongo’ at the command shell on your master node. Then execute the following 2 commands to retrieve the node config information in json format.
use graylog
db.nodes.find()
Provide this output for review.
Is it possible you have nodes that were registered multiple times?