Upgrade from 3.3.9 to Graylog 4.0 failed

Hey everyone,

I tried upgrading my Graylog instance (Docker) to Version 4.0
Unlikely the Upgrade fails. At least the Container isn’t starting up anymore. As far as I see it relates to the LDAP Plugin. I had this one active a while ago but it is disabled in the Settings.

Error Message:

Exception in thread "main" java.lang.NoClassDefFoundError: org/graylog2/security/realm/LdapUserAuthenticator
at java.lang.Class.getDeclaredConstructors0(Native Method)
at java.lang.Class.privateGetDeclaredConstructors(Class.java:2671)
at java.lang.Class.getDeclaredConstructors(Class.java:2020)
at com.google.inject.spi.InjectionPoint.forConstructorOf(InjectionPoint.java:245)
at com.google.inject.internal.ConstructorBindingImpl.create(ConstructorBindingImpl.java:115)
at com.google.inject.internal.InjectorImpl.createUninitializedBinding(InjectorImpl.java:706)
at com.google.inject.internal.InjectorImpl.createJustInTimeBinding(InjectorImpl.java:930)
at com.google.inject.internal.InjectorImpl.createJustInTimeBindingRecursive(InjectorImpl.java:852)
at com.google.inject.internal.InjectorImpl.getJustInTimeBinding(InjectorImpl.java:291)
at com.google.inject.internal.InjectorImpl.getBindingOrThrow(InjectorImpl.java:222)
at com.google.inject.internal.InjectorImpl.getInternalFactory(InjectorImpl.java:938)
at com.google.inject.internal.FactoryProxy.notify(FactoryProxy.java:48)
at com.google.inject.internal.ProcessedBindingData.runCreationListeners(ProcessedBindingData.java:60)
at com.google.inject.internal.InternalInjectorCreator.initializeStatically(InternalInjectorCreator.java:133)
at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:106)
at com.google.inject.Guice.createInjector(Guice.java:87)
at org.graylog2.shared.bindings.GuiceInjectorHolder.createInjector(GuiceInjectorHolder.java:34)
at org.graylog2.bootstrap.CmdLineTool.setupInjector(CmdLineTool.java:381)
at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:196)
at org.graylog2.bootstrap.Main.main(Main.java:50)
Caused by: java.lang.ClassNotFoundException: org.graylog2.security.realm.LdapUserAuthenticator
at java.net.URLClassLoader.findClass(URLClassLoader.java:382)
at java.lang.ClassLoader.loadClass(ClassLoader.java:418)
at java.net.FactoryURLClassLoader.loadClass(URLClassLoader.java:817)
at java.lang.ClassLoader.loadClass(ClassLoader.java:351)

Any help is appreciated. Thanks
(Elatsticsearch and MongoDB Release are fitting the Graylog Version to avoid any questions related)

Even though it is disabled, it may be evaluating it on startup - I have had errors on the “threat Intelligence Lookup” plugin with IP related functions even though I have it disabled… have you tried removing it from the plugin directory?

The LDAP Auth isn’t in the Plugin Folder so i guess there is no option to remove it?


you should check if you have all necessary plugins and no not longer needed plugins in your plugin folder.

Did you mount plugins manually?

The plugin names have the version in them. If you have an enterprise license (paid or under-5gb) then you need to make sure you update those too. Her is what mine at 4.0.1 look like. No added plugins:

dude@TGS007:~$ ls -l /usr/share/graylog-server/plugin/
total 171248
-rw-r–r-- 1 dude dude 20239730 Nov 25 13:44 graylog-plugin-aws-4.0.1.jar
-rw-r–r-- 1 dude dude 6463269 Nov 25 13:44 graylog-plugin-collector-4.0.1.jar
-rw-r–r-- 1 dude dude 31779150 Nov 25 13:45 graylog-plugin-enterprise-4.0.1.jar
-rw-r–r-- 1 dude dude 23306251 Nov 25 13:45 graylog-plugin-enterprise-integrations-4.0.1.jar
-rw-r–r-- 1 dude dude 32429272 Nov 25 13:45 graylog-plugin-integrations-4.0.1.jar
-rw-r–r-- 1 dude dude 7999532 Nov 25 13:44 graylog-plugin-threatintel-4.0.1.jar
-rw-r–r-- 1 dude dude 23275853 Nov 25 13:44 graylog-storage-elasticsearch6-4.0.1.jar
-rw-r–r-- 1 dude dude 29840631 Nov 25 13:44 graylog-storage-elasticsearch7-4.0.1.jar
-rw-r–r-- 1 dude dude 48 Nov 25 13:45 LICENSE-ENTERPRISE

First of all I have the plugins mounted.
Secondly I an running without enterprise.

Are you using LDAP? If so double check all the settings or perhaps even remove and rebuild them? Not much else to go on… any other oddities you can post?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.