We just started testing GL3. One one server we are getting many messages that say the following:
Got automount request for /proc/sys/fs/binfmt_misc, triggered by 935239 (graylog-sidecar)
If I disable /var/log/messages it appears to stop.
Our test config looks like this:
Needed for Graylog
fields_under_root: true
fields.collector_node_id: {sidecar.nodeName}
fields.gl2_source_collector: {sidecar.nodeId}
filebeat.inputs:
- input_type: log
paths:- /var/log/messages
- /var/log/apache2/error_log
- /var/log/apache2/modsec_audit.log
- /usr/local/cpanel/logs/access_log
- /var/lib/mysql/*error.log
type: log
output.logstash:
hosts: [“myserver.example.com:5044”]
path:
data: /var/lib/graylog-sidecar/collectors/filebeat/data
logs: /var/lib/graylog-sidecar/collectors/filebeat/log