Hello,
I try to configure a graylog instance since some days and I have always an error starting graylog-server.
Configuration :
Graylog : 4.0.2-1
Elasticsearch : 7.10.2 oss
MongoDb : 4.2.12
Java : /usr/lib/jvm/java-11-openjdk-amd64/bin/java
Serveurs : debian 10 Linux 4.19.0-14-amd64 #1 SMP Debian 4.19.171-2 (2021-01-30) x86_64 GNU/Linux
Graylog /Mongodb are on the same servers : 3 nodes
Elasticsearch : 3 nodes
Elasticsearch started and seems ok :
MongoDb started and replicaSet seems ok on all servers :
● mongod.service - MongoDB Database Server
Loaded: loaded (/lib/systemd/system/mongod.service; enabled; vendor preset: enabled)
Active: active (running) since Sat 2021-02-06 13:13:55 CET; 4h 10min ago
Docs:
Main PID: 1929 (mongod)
Memory: 237.6M
CGroup: /system.slice/mongod.service
└─1929 /usr/bin/mongod --config /etc/mongod.conf
févr. 06 14:38:33 frainf081 systemd[1]: /lib/systemd/system/mongod.service:10: PIDFile= references path below legacy directory /var/run/, updating /var/run/mongodb/mongod.pid → /run/mong
graylog:PRIMARY> rs.status()
{
“set” : “graylog”,
“date” : ISODate(“2021-02-06T16:25:25.407Z”),
“myState” : 1,
“term” : NumberLong(8),
“syncingTo” : “”,
“syncSourceHost” : “”,
“syncSourceId” : -1,
“heartbeatIntervalMillis” : NumberLong(2000),
“majorityVoteCount” : 1,
“writeMajorityCount” : 1,
“optimes” : {
“lastCommittedOpTime” : {
“ts” : Timestamp(1612628718, 1),
“t” : NumberLong(8)
},
“lastCommittedWallTime” : ISODate(“2021-02-06T16:25:18.221Z”),
“readConcernMajorityOpTime” : {
“ts” : Timestamp(1612628718, 1),
“t” : NumberLong(8)
},
“readConcernMajorityWallTime” : ISODate(“2021-02-06T16:25:18.221Z”),
“appliedOpTime” : {
“ts” : Timestamp(1612628718, 1),
“t” : NumberLong(8)
},
“durableOpTime” : {
“ts” : Timestamp(1612628718, 1),
“t” : NumberLong(8)
},
“lastAppliedWallTime” : ISODate(“2021-02-06T16:25:18.221Z”),
“lastDurableWallTime” : ISODate(“2021-02-06T16:25:18.221Z”)
},
“lastStableRecoveryTimestamp” : Timestamp(1612628688, 1),
“lastStableCheckpointTimestamp” : Timestamp(1612628688, 1),
“electionCandidateMetrics” : {
“lastElectionReason” : “electionTimeout”,
“lastElectionDate” : ISODate(“2021-02-06T12:14:07.895Z”),
“electionTerm” : NumberLong(8),
“lastCommittedOpTimeAtElection” : {
“ts” : Timestamp(1612613394, 1),
“t” : NumberLong(7)
},
“lastSeenOpTimeAtElection” : {
“ts” : Timestamp(1612613394, 1),
“t” : NumberLong(7)
},
“numVotesNeeded” : 1,
“priorityAtElection” : 1,
“electionTimeoutMillis” : NumberLong(10000),
“numCatchUpOps” : NumberLong(0),
“newTermStartDate” : ISODate(“2021-02-06T12:14:07.897Z”),
“wMajorityWriteAvailabilityDate” : ISODate(“2021-02-06T12:14:07.962Z”)
},
“members” : [
{
“_id” : 0,
“name” : “/////:27017”,
“health” : 1,
“state” : 1,
“stateStr” : “PRIMARY”,
“uptime” : 15090,
“optime” : {
“ts” : Timestamp(1612628718, 1),
“t” : NumberLong(8)
},
“optimeDate” : ISODate(“2021-02-06T16:25:18Z”),
“syncingTo” : “”,
“syncSourceHost” : “”,
“syncSourceId” : -1,
“infoMessage” : “”,
“electionTime” : Timestamp(1612613647, 1),
“electionDate” : ISODate(“2021-02-06T12:14:07Z”),
“configVersion” : 4,
“self” : true,
“lastHeartbeatMessage” : “”
},
{
“_id” : 1,
“name” : “/////:27017”,
“health” : 1,
“state” : 2,
“stateStr” : “SECONDARY”,
“uptime” : 14985,
“optime” : {
“ts” : Timestamp(1612628718, 1),
“t” : NumberLong(8)
},
“optimeDurable” : {
“ts” : Timestamp(1612628718, 1),
“t” : NumberLong(8)
},
“optimeDate” : ISODate(“2021-02-06T16:25:18Z”),
“optimeDurableDate” : ISODate(“2021-02-06T16:25:18Z”),
“lastHeartbeat” : ISODate(“2021-02-06T16:25:24.154Z”),
“lastHeartbeatRecv” : ISODate(“2021-02-06T16:25:25.194Z”),
“pingMs” : NumberLong(0),
“lastHeartbeatMessage” : “”,
“syncingTo” : “////:27017”,
“syncSourceHost” : “/////:27017”,
“syncSourceId” : 0,
“infoMessage” : “”,
“configVersion” : 4
},
{
“_id” : 2,
“name” : “/////:27017”,
“health” : 1,
“state” : 2,
“stateStr” : “SECONDARY”,
“uptime” : 14881,
“optime” : {
“ts” : Timestamp(1612628718, 1),
“t” : NumberLong(8)
},
“optimeDurable” : {
“ts” : Timestamp(1612628718, 1),
“t” : NumberLong(8)
},
“optimeDate” : ISODate(“2021-02-06T16:25:18Z”),
“optimeDurableDate” : ISODate(“2021-02-06T16:25:18Z”),
“lastHeartbeat” : ISODate(“2021-02-06T16:25:24.155Z”),
“lastHeartbeatRecv” : ISODate(“2021-02-06T16:25:25.334Z”),
“pingMs” : NumberLong(0),
“lastHeartbeatMessage” : “”,
“syncingTo” : “////:27017”,
“syncSourceHost” : “////:27017”,
“syncSourceId” : 1,
“infoMessage” : “”,
“configVersion” : 4
}
],
“ok” : 1,
“$clusterTime” : {
“clusterTime” : Timestamp(1612628718, 1),
“signature” : {
“hash” : BinData(0,“AAAAAAAAAAAAAAAAAAAAAAAAAAA=”),
“keyId” : NumberLong(0)
}
},
“operationTime” : Timestamp(1612628718, 1)
}
User administrator and root created and configured.
— Config :
cat /etc/mongod.conf |grep -v “#” | sed ‘/^$/d’
storage:
dbPath: /var/lib/mongodb/graylog/
journal:
enabled: true
systemLog:
destination: file
logAppend: true
path: /var/log/mongodb/mongod.log
net:
port: 27017
bindIp: 127.0.0.1,
processManagement:
timeZoneInfo: /usr/share/zoneinfo
replication:
oplogSizeMB: 128
replSetName: graylog
enableMajorityReadConcern: true
Elasticsearch :
● elasticsearch.service - Elasticsearch
Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled)
Active: active (running) since Sat 2021-02-06 11:25:25 CET; 6h ago
Docs:
Main PID: 3999 (java)
Tasks: 34 (limit: 4915)
Memory: 1.2G
CGroup: /system.slice/elasticsearch.service
└─3999 /usr/share/elasticsearch/jdk/bin/java -Xshare:auto -Des.networkaddress.cache.ttl=60 -Des.networkaddress.cache.negative.ttl=10 -XX:+AlwaysPreTouch -Xss1m -Djava.awt.headless=true -Dfile.encoding
févr. 06 11:25:18 //// systemd[1]: Starting Elasticsearch…
févr. 06 11:25:25 //// systemd[1]: Started Elasticsearch.
root@///:~# curl -XGET ‘http:///////:9200/_cluster/state?pretty’
{
“cluster_name” : “GraylogDSINEW”,
“cluster_uuid” : “GqKp2q5MTsKS9q8v_61npA”,
“version” : 8,
“state_uuid” : “S8GsGTGETHOMJsusRSM8Kw”,
“master_node” : “wwHWF9S0SpmfEkXN0HwsEQ”,
“blocks” : { },
“nodes” : {
“pXJz46kDTteeRLk11UjEyw” : {
“name” : “//////”,
“ephemeral_id” : “aG2FADcNRluTBhi775gmNA”,
“transport_address” : “/////:9300”,
“attributes” : { }
},
“K–qTb-ORKukKiIl0UiX0A” : {
“name” : “/////”,
“ephemeral_id” : “Q2EoMuUjQ_mqop4mJ6aJcg”,
“transport_address” : “/////:9300”,
“attributes” : { }
},
“wwHWF9S0SpmfEkXN0HwsEQ” : {
“name” : “//////”,
“ephemeral_id” : “up9wcrO2Q8a_cUKFpVVEmg”,
“transport_address” : “//////:9300”,
“attributes” : { }
}
},
“metadata” : {
“cluster_uuid” : “GqKp2q5MTsKS9q8v_61npA”,
“cluster_uuid_committed” : true,
“cluster_coordination” : {
“term” : 1,
“last_committed_config” : [
“wwHWF9S0SpmfEkXN0HwsEQ”,
“K–qTb-ORKukKiIl0UiX0A”,
“pXJz46kDTteeRLk11UjEyw”
],
“last_accepted_config” : [
“wwHWF9S0SpmfEkXN0HwsEQ”,
“K–qTb-ORKukKiIl0UiX0A”,
“pXJz46kDTteeRLk11UjEyw”
],
“voting_config_exclusions” :
},
“templates” : { },
“indices” : { },
“index-graveyard” : {
“tombstones” :
}
},
“routing_table” : {
“indices” : { }
},
“routing_nodes” : {
“unassigned” : ,
“nodes” : {
“K–qTb-ORKukKiIl0UiX0A” : ,
“wwHWF9S0SpmfEkXN0HwsEQ” : ,
“pXJz46kDTteeRLk11UjEyw” :
}
}
}
elasticsearch.yml :
root@//////:~# cat /etc/elasticsearch/elasticsearch.yml |grep -v “#” | sed '/^/d'
cluster.name: GraylogDSINEW
node.name: {HOSTNAME}
path.data: /data/graylog/
path.logs: /data/log/
network.host: ${HOSTNAME}
http.port: 9200
discovery.seed_hosts: ["/////", “/////”, “////”]
So everything seems of for this. But when I try to start Graylog, I have this error :
2021-02-06T17:34:17.818+01:00 INFO [CmdLineTool] Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin]
2021-02-06T17:34:17.820+01:00 INFO [CmdLineTool] Loaded plugin: Enterprise Integrations 4.0.2 [org.graylog.enterprise.integrations.EnterpriseIntegrationsPlugin]
2021-02-06T17:34:17.820+01:00 INFO [CmdLineTool] Loaded plugin: Integrations 4.0.2 [org.graylog.integrations.IntegrationsPlugin]
2021-02-06T17:34:17.821+01:00 INFO [CmdLineTool] Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin]
2021-02-06T17:34:17.821+01:00 INFO [CmdLineTool] Loaded plugin: Graylog Enterprise 4.0.2 [org.graylog.plugins.enterprise.EnterprisePlugin]
2021-02-06T17:34:17.822+01:00 INFO [CmdLineTool] Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin]
2021-02-06T17:34:17.822+01:00 INFO [CmdLineTool] Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin]
2021-02-06T17:34:17.822+01:00 INFO [CmdLineTool] Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin]
2021-02-06T17:34:17.972+01:00 ERROR [CmdLineTool] Invalid configuration
com.github.joschi.jadconfig.ValidationException: Couldn’t run validator method
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:227) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.process(JadConfig.java:100) ~[graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [graylog.jar:?]
at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [graylog.jar:?]
at org.graylog2.bootstrap.Main.main(Main.java:50) [graylog.jar:?]
Caused by: java.lang.reflect.InvocationTargetException
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?]
at com.github.joschi.jadconfig.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:53) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:221) ~[graylog.jar:?]
… 5 more
Caused by: java.lang.IllegalArgumentException: state should be: databaseName does not contain ’ ’
at com.mongodb.assertions.Assertions.isTrueArgument(Assertions.java:99) ~[graylog.jar:?]
at com.mongodb.MongoNamespace.checkDatabaseNameValidity(MongoNamespace.java:61) ~[graylog.jar:?]
at com.mongodb.ConnectionString.(ConnectionString.java:375) ~[graylog.jar:?]
at com.mongodb.MongoClientURI.(MongoClientURI.java:256) ~[graylog.jar:?]
at org.graylog2.configuration.MongoDbConfiguration.getMongoClientURI(MongoDbConfiguration.java:59) ~[graylog.jar:?]
at org.graylog2.configuration.MongoDbConfiguration.validate(MongoDbConfiguration.java:64) ~[graylog.jar:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
at java.lang.reflect.Method.invoke(Method.java:566) ~[?:?]
at com.github.joschi.jadconfig.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:53) ~[graylog.jar:?]
at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:221) ~[graylog.jar:?]
… 5 more
Graylog config on master (same for other but not master) :
root@/////:~# cat /etc/graylog/server/server.conf |grep -v “#” | sed ‘/^$/d’
is_master = true
node_id_file = /etc/graylog/server/node-id
password_secret = nH2ePqmjadz4ydXUCm0RAigWuRrpVRApTBMUg6elmVsYHP3S5y3FIiDsgTKeroSD56iFwZySzpbFB5CI7OOBuaySf7DDGfuE
root_username = administrator
root_password_sha2 = e110612af814c31942a43b71892b4acbab6653fa2262883d8b834082fbf8560e
root_timezone = CET
bin_dir = /usr/share/graylog-server/bin
data_dir = /var/lib/graylog-server
plugin_dir = /usr/share/graylog-server/plugin
http_bind_address = hostname:9000
http_external_uri = http:hostname:9000/
elasticsearch_hosts = http://hostname:9200,hostname:9200,http://hostname:9200
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false
allow_highlighting = true
elasticsearch_analyzer = standard
output_batch_size = 500
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 32
outputbuffer_processors = 64
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://@hostname/graylog, hostname/graylog, hostname/graylog?replicaSet=graylog
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
transport_email_enabled = true
transport_email_hostname = /////////
transport_email_port = 25
transport_email_use_ssl = false
proxied_requests_thread_pool_size = 32
content_packs_loader_enabled = false
content_packs_dir = /usr/share/graylog-server/contentpacks
Graylog, unable to start for this alert :
com.github.joschi.jadconfig.ValidationException: Couldn’t run validator method
Caused by: java.lang.IllegalArgumentException: state should be: databaseName does not contain ’ ’
I searched many time on internet but I can’t find anything…
Thank you for your help.
Regards
PM