Upgrade 2.1.2 to 2.2


(MC) #1

Hi,

I have two graylog servers clustered. One is configured as the master with full configuration the other as bakend-server. I upgraded both virtual appliances from 2.1.2 to 2.2.0. Before the upgrade everything was working fine. Now I get the following two errors over and over. Any help with this will be great.

Thank you

2017-02-18_19:44:32.84410 [3138]: index [graylog_400], type [message], id [4a624fe1-f612-11e6-8e43-005056a7396f], message [MapperParsingException[failed to parse [EventDate]]; nested: IllegalArgumentException[Invalid format: "2017/02/18" is malformed at "/02/18"];]


2017-02-18_19:44:42.10502 2017-02-18 11:44:42,094 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Unable to decode raw message RawMessage{id=11113680-f60c-11e6-ad76-005056a7396f, journalOffset=9895355096, codec=syslog, payloadSize=234, timestamp=2017-02-18T18:57:16.776Z, remoteAddress=/122.123.123.2:64220} on input <57239495e765a00aa151081e>.
2017-02-18_19:44:42.10619 2017-02-18 11:44:42,094 ERROR: org.graylog2.shared.buffers.processors.DecodingProcessor - Error processing message RawMessage{id=11113680-f60c-11e6-ad76-005056a7396f, journalOffset=9895355096, codec=syslog, payloadSize=234, timestamp=2017-02-18T18:57:16.776Z, remoteAddress=/122.123.123.2:64220}
2017-02-18_19:44:42.10683 java.lang.IllegalArgumentException: Invalid format: "1984951:" is malformed at ":"
2017-02-18_19:44:42.10793       at org.joda.time.format.DateTimeFormatter.parseDateTime(DateTimeFormatter.java:945) ~[graylog.jar:?]
2017-02-18_19:44:42.10855       at org.joda.time.DateTime.parse(DateTime.java:160) ~[graylog.jar:?]
2017-02-18_19:44:42.10955       at org.joda.time.DateTime.parse(DateTime.java:149) ~[graylog.jar:?]
2017-02-18_19:44:42.10995       at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parseDate(SyslogServerEvent.java:108) ~[graylog.jar:?]
2017-02-18_19:44:42.11107       at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parsePriority(SyslogServerEvent.java:136) ~[graylog.jar:?]
2017-02-18_19:44:42.11159       at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.parse(SyslogServerEvent.java:152) ~[graylog.jar:?]
2017-02-18_19:44:42.11249       at org.graylog2.syslog4j.server.impl.event.SyslogServerEvent.<init>(SyslogServerEvent.java:50) ~[graylog.jar:?]
2017-02-18_19:44:42.11298       at org.graylog2.inputs.codecs.SyslogCodec.parse(SyslogCodec.java:123) ~[graylog.jar:?]
2017-02-18_19:44:42.11414       at org.graylog2.inputs.codecs.SyslogCodec.decode(SyslogCodec.java:91) ~[graylog.jar:?]
2017-02-18_19:44:42.11467       at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:146) ~[graylog.jar:?]
2017-02-18_19:44:42.11560       at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:87) [graylog.jar:?]
2017-02-18_19:44:42.11603       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:79) [graylog.jar:?]
2017-02-18_19:44:42.11701       at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:45) [graylog.jar:?]
2017-02-18_19:44:42.11774       at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
2017-02-18_19:44:42.11873       at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
2017-02-18_19:44:42.11919       at java.lang.Thread.run(Thread.java:745) [?:1.8.0_101]

(Jan Doberstein) #2

Hej @Marsel

That might be related to https://github.com/Graylog2/graylog2-server/pull/3503

We will release a bug fix release shortly.

Regards
Jan


(MC) #3

Hi Jan,

Thank you for your reply. I upgraded to 2.2.1 but it didn’t’ not fix the issue. I created a new raw input with some parsing, and its working great.

Again, thank you very much for your help.
Marsel