Retention strategy issue/error after 4.1 > 5.1 upgrade

Graylog Central (peer support)
1

Hello

Long time no seen. Haven’t actively used graylog for a while and now when doing some summer maintenance I thought it would be a nice exercise in self torture to take a few trips to hell and back and do the upgrade from 4.1 to 5.1. :flushed: Surprisingly, not everything broke. :stuck_out_tongue_winking_eye:

1. Describe your incident:
After upgrade to 5.1 my indices for winbeat complains about.

Summary for strategy
org.graylog.plugins.archive.indexer.retention.strategies.ArchiveRetentionStrategy not found!

image
image3558×846 281 KB

I think that winbeat setup came from @tmacgbay if i recall correctly. But as I said, it was a few full moons ago since I messed about with it.

Not sure if related to that I had enterprise plugins installed previously and that I havent managed to figure out how to install that graylog-enterprise with small business license over the regular installation yet? Somewhat messy documentation to be honest.

2. Describe your environment:

  • OS Information: CentOS 8

  • Package Version:
    graylog-server.x86_64 5.1.3-1
    mongodb-org.x86_64 5.0.19-1.el8 @mongodb-org-5.0
    mongodb-org-database.x86_64 5.0.19-1.el8 @mongodb-org-5.0
    mongodb-org-database-tools-extra.x86_64 5.0.19-1.el8 @mongodb-org-5.0
    mongodb-org-mongos.x86_64 5.0.19-1.el8 @mongodb-org-5.0
    mongodb-org-server.x86_64 5.0.19-1.el8 @mongodb-org-5.0
    mongodb-org-shell.x86_64 5.0.19-1.el8 @mongodb-org-5.0
    mongodb-org-tools.x86_64 5.0.19-1.el8 @mongodb-org-5.0
    elasticsearch-oss.x86_64 7.10.2-1 @elasticsearch-7.x

  • Service logs, configurations, and environment variables:

2023-07-19T18:09:43.283+02:00 WARN [IndexRetentionThread] Retention strategy “org.graylog.plugins.archive.indexer.retention.strategies.ArchiveRetentionStrategy” not found, not running index retention!

3. What steps have you already taken to try and solve the problem?
Cried, screamed, asked a stranger for a hug.

4. How can the community help?
Have anyone seen something similar? Thoughts for remedy?

2

Restored my snapshot from pre upgrade, and yes. For sure seems to be an “enterprise issue”. Had a clavister firewall that went batshit crazy and killed our free enterprise license way way back so apparently the archive of index didn’t work there either.

Curious, is there a sensible path to upgrade -server to -enterprise and keep al settings and stuffs so that you can add the small business license?

image
image2562×1728 349 KB

image
image2922×1256 341 KB

3

It’s not hard. You have to install the enterprise version over the top of your OSS instance. Using the equivalent GL version, in this case 5.1, it will install all the required plugins for you. Then you add the license and, provided you’re under 2GB/day of ingestion, Bob’s your uncle!

Since all configuration information lives in Mongo, you won’t lose anything, even if you had to reinstall Graylog completely. As long as you upgrade 4.1 to 5.1 before you reinstall Graylog, any changes needed in Mongo will have already happened. You could then point a brand new 5.1 installation at Mongo and it will pick up where you left off.

As with all major undertakings, be sure to back up Mongo before you start. Mongodump is your friend…

4

Ah! Cool. Thanks @joe.gross :pray: But can I do that with yum? Don’t remember the exact errors I got but think it failed on installing enterprise over “server” when I tried due to a bunch of conflicts. :thinking:

5

I felt adventurous and ran it with --allowerasing (sudo yum install graylog-enterprise --allowerasing). SInce it’s a VM I took a snapshot before this but all seems to have worked out and seems to be running fine.

Thanks again @joe.gross :pray:

1 Like
6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.