Upgrade from 3.3.9 to Graylog 4.0 failed

[P3RF3CTION]

Hey everyone,

I tried upgrading my Graylog instance (Docker) to Version 4.0
Unlikely the Upgrade fails. At least the Container isn’t starting up anymore. As far as I see it relates to the LDAP Plugin. I had this one active a while ago but it is disabled in the Settings.

Error Message:

Exception in thread "main" java.lang.NoClassDefFoundError: org/graylog2/security/realm/LdapUserAuthenticator
at java.lang.Class.getDeclaredConstructors0(Native Method)
at java.lang.Class.privateGetDeclaredConstructors(Class.java:2671)
at java.lang.Class.getDeclaredConstructors(Class.java:2020)
at com.google.inject.spi.InjectionPoint.forConstructorOf(InjectionPoint.java:245)
at com.google.inject.internal.ConstructorBindingImpl.create(ConstructorBindingImpl.java:115)
at com.google.inject.internal.InjectorImpl.createUninitializedBinding(InjectorImpl.java:706)
at com.google.inject.internal.InjectorImpl.createJustInTimeBinding(InjectorImpl.java:930)
at com.google.inject.internal.InjectorImpl.createJustInTimeBindingRecursive(InjectorImpl.java:852)
at com.google.inject.internal.InjectorImpl.getJustInTimeBinding(InjectorImpl.java:291)
at com.google.inject.internal.InjectorImpl.getBindingOrThrow(InjectorImpl.java:222)
at com.google.inject.internal.InjectorImpl.getInternalFactory(InjectorImpl.java:938)
at com.google.inject.internal.FactoryProxy.notify(FactoryProxy.java:48)
at com.google.inject.internal.ProcessedBindingData.runCreationListeners(ProcessedBindingData.java:60)
at com.google.inject.internal.InternalInjectorCreator.initializeStatically(InternalInjectorCreator.java:133)
at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:106)
at com.google.inject.Guice.createInjector(Guice.java:87)
at org.graylog2.shared.bindings.GuiceInjectorHolder.createInjector(GuiceInjectorHolder.java:34)
at org.graylog2.bootstrap.CmdLineTool.setupInjector(CmdLineTool.java:381)
at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:196)
at org.graylog2.bootstrap.Main.main(Main.java:50)
Caused by: java.lang.ClassNotFoundException: org.graylog2.security.realm.LdapUserAuthenticator
at java.net.URLClassLoader.findClass(URLClassLoader.java:382)
at java.lang.ClassLoader.loadClass(ClassLoader.java:418)
at java.net.FactoryURLClassLoader.loadClass(URLClassLoader.java:817)
at java.lang.ClassLoader.loadClass(ClassLoader.java:351)

Any help is appreciated. Thanks
(Elatsticsearch and MongoDB Release are fitting the Graylog Version to avoid any questions related)

[tmacgbay]

Even though it is disabled, it may be evaluating it on startup - I have had errors on the “threat Intelligence Lookup” plugin with IP related functions even though I have it disabled… have you tried removing it from the plugin directory?

[P3RF3CTION]

The LDAP Auth isn’t in the Plugin Folder so i guess there is no option to remove it?

[jan (Jan Doberstein)]

he @P3RF3CTION

you should check if you have all necessary plugins and no not longer needed plugins in your plugin folder.

Did you mount plugins manually?

[tmacgbay]

The plugin names have the version in them. If you have an enterprise license (paid or under-5gb) then you need to make sure you update those too. Her is what mine at 4.0.1 look like. No added plugins:

dude@TGS007:~$ ls -l /usr/share/graylog-server/plugin/
total 171248
-rw-r–r-- 1 dude dude 20239730 Nov 25 13:44 graylog-plugin-aws-4.0.1.jar
-rw-r–r-- 1 dude dude 6463269 Nov 25 13:44 graylog-plugin-collector-4.0.1.jar
-rw-r–r-- 1 dude dude 31779150 Nov 25 13:45 graylog-plugin-enterprise-4.0.1.jar
-rw-r–r-- 1 dude dude 23306251 Nov 25 13:45 graylog-plugin-enterprise-integrations-4.0.1.jar
-rw-r–r-- 1 dude dude 32429272 Nov 25 13:45 graylog-plugin-integrations-4.0.1.jar
-rw-r–r-- 1 dude dude 7999532 Nov 25 13:44 graylog-plugin-threatintel-4.0.1.jar
-rw-r–r-- 1 dude dude 23275853 Nov 25 13:44 graylog-storage-elasticsearch6-4.0.1.jar
-rw-r–r-- 1 dude dude 29840631 Nov 25 13:44 graylog-storage-elasticsearch7-4.0.1.jar
-rw-r–r-- 1 dude dude 48 Nov 25 13:45 LICENSE-ENTERPRISE

[P3RF3CTION]

First of all I have the plugins mounted.
Secondly I an running without enterprise.

[tmacgbay]

Are you using LDAP? If so double check all the settings or perhaps even remove and rebuild them? Not much else to go on… any other oddities you can post?