Yesterday I installed license on graylog. Now I see many WARN message in logs:
WARN : org.graylog.plugins.license.LicenseChecker - License violation - Detected irregular traffic records
It’s came every 2-3 minutes. no any info. I’ll try curl to https://api.graylog.com and have answer 200 - that’s all ok.
I have 500-800 Mb logs per day this is < 5Gb (I see it in Enterprise page).
Hey @grokon,
This is a hint towards Graylog’s internal checks that do not have to do anything with the amount of data sent out. Graylog licenses check the Graylog installation if it was tampered with, for example if the message size counters are non-vanilla and report smaller values than actually measured.
The first question to ask in this case: Do you run the official version of Graylog or do you have a self-compiled version running?
Greetings,
Philipp
I have docker version from: graylog/graylog:2.4. And install plugins: slack/aggregates/metrics-reporter-prometheus/enterprise
and set:
GRAYLOG_SERVER_JAVA_OPTS: ‘-Xms1g -Xmx1g -XX:NewRatio=1 -XX:MaxMetaspaceSize=256m -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow’
maybe problems with it?
Uff, I don’t know.
For an answer to that you’ll need to wait on somebody from @Graylog_staff to respond.
But for that I would recommend posting a new issue in the Graylog Github Issues, since it is an issue that could impact more people.
Greetings,
Philipp
The line is not an issue.
We try to detect if your traffic stats looks resonable. In some situations - with low volumen - this can happen. That is the reason we currently only log this line to have the knowledge that this case happened again.
The measurement will become better and better with each version and should we reach the point that everything is working - with all edge cases - then this message will be changed.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
