Ubuntu Sidecar installer problems

Graylog Central (peer support)
, ,
1

I have a fresh built VM running Ubuntu 16.04.2, and then installed the Sidecar collector v0.1.4-1. the sidecar collector service refuses to run, stating “[filebeat] Backend finished unexpectedly, trying to restart” three times, and then quitting.

Is there something I can do to fix this?

2

Please post the complete contents of the logs of the Collector Sidecar.
Additionally you should post the configuration of the Collector Sidecar and the generated configuration for Filebeat.

3

Sidecar config:

server_url: http://10.10.21.37:9000/api/
update_interval: 10
tls_skip_verify: false
send_status: true
list_log_files:
node_id: graylog-collector-sidecar
collector_id: file:/etc/graylog/collector-sidecar/collector-id
cache_path: /var/cache/graylog/collector-sidecar
log_path: /var/log/graylog/collector-sidecar
log_rotation_time: 86400
log_max_age: 604800
tags:
    - linux
backends:
    - name: nxlog
      enabled: false
      binary_path: /usr/bin/nxlog
      configuration_path: /etc/graylog/collector-sidecar/generated/nxlog.conf
    - name: filebeat
      enabled: true
      binary_path: /usr/bin/filebeat
      configuration_path: /etc/graylog/collector-sidecar/generated/filebeat.yml

Sidecar logs:

time="2017-10-24T10:08:11-06:00" level=info msg="Starting signal distributor"
time="2017-10-24T10:08:11-06:00" level=info msg="[filebeat] Starting (exec driver)"
time="2017-10-24T10:08:12-06:00" level=error msg="[filebeat] Backend finished unexpectedly, trying to restart 1/3."
time="2017-10-24T10:08:12-06:00" level=info msg="[filebeat] Stopping"
time="2017-10-24T10:08:14-06:00" level=info msg="[filebeat] Starting (exec driver)"
time="2017-10-24T10:08:15-06:00" level=error msg="[filebeat] Backend finished unexpectedly, trying to restart 2/3."
time="2017-10-24T10:08:15-06:00" level=info msg="[filebeat] Stopping"
time="2017-10-24T10:08:17-06:00" level=info msg="[filebeat] Starting (exec driver)"
time="2017-10-24T10:08:18-06:00" level=error msg="[filebeat] Backend finished unexpectedly, trying to restart 3/3."
time="2017-10-24T10:08:18-06:00" level=info msg="[filebeat] Stopping"
time="2017-10-24T10:08:20-06:00" level=info msg="[filebeat] Starting (exec driver)"
time="2017-10-24T10:08:21-06:00" level=info msg="[RequestConfiguration] No configuration found for configured tags!"
time="2017-10-24T10:08:21-06:00" level=error msg="[filebeat] Unable to start collector after 3 tries, giving up!"

I’m not sure where to find the config for Filebeat. Still looking.

4

There does not appear to be a filebeat configuration file. There is no filebeat folder in /etc.

5

I’ve done a search of the whole hard drive. There is no filebeat.yml file at all. This is probably why it isn’t working. Is there something extra I can to do to fix this?

6

The Filebeat configuration file should be located at /etc/graylog/collector-sidecar/generated/filebeat.yml (as you can read in your Collector Sidecar configuration).
If that file doesn’t exist, make sure that the Collector Sidecar is allowed to write into the given directory (/etc/graylog/collector-sidecar/generated).

7

Yeah, that folder is there and is writable, and the file isn’t there. Even trying on a full new VM, installing Ubuntu 16.04.2 and then the sidecar app, I get the same results: folder exists, filebeat.yml not there.

8

What’s the output of the following command?

namei -l /etc/graylog/collector-sidecar/generated

Have you created a configuration with the tag “linux” in the Graylog web interface?
http://docs.graylog.org/en/2.3/pages/collector_sidecar.html#step-by-step-guide

9

  1. Here’s the response I get from that command:
    f: /etc/graylog/collector-sidecar/generated
    drwxr-xr-x root root /
    drwxr-xr-x root root etc
    drwxrwxr-x root root graylog
    drwxrwxr-x root root collector-sidecar
    drwxrwxr-x root root generated

  2. No, I had not. I hadn’t been able to get the sidecar collector daemon to run, so I hadn’t moved on. Are you saying that it gets some of this local config from the server? That seems a bit counter-intuitive to me. I’ve created it now. We’ll see how it works.

10

That’s the whole point of the Collector Sidecar: Enabling users to configure the log shippers on remote systems in the Graylog web interface.

11

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.