Web UI reloads every 20 second


(123dev) #1

We’ve been having a weird issue since we upgraded from 2.1.3 to 2.2.0
The Web UI reloads every 20 seconds or so, and briefly displays the following error


Effectively making it useless, as it keeps on trying to reload a search or closes the input details / configs …

This was not an issue prior to the upgrade.

I did some digging and discovered that the problem occurs when it tries to load
http://10.20.2.75:9000/api/system/cluster/node

Where authorization fails.

Why is this happening.
I worked around it by accessing http://10.20.2.75:9000/api/system/cluster/node directly and entering my credentials at the login prompt.
But this only works until I close my session.

I was able to reproduce the issue by using another browser, I’m logged in and able to access everything in graylog, however the page reloads every 20 seconds when it attempts to access http://10.20.2.75:9000/api/system/cluster/node

Is there a bug somewhere or is this something to do with our configuration.
This is a staging server which is a single instance, non-clustered environment, we use this before doing full production upgrade.

On this instance, the configuration changes from the default sample are very minimal.

55c55
< password_secret =
---
> password_secret = redacted
66c66
< root_password_sha2 =
---
> root_password_sha2 = redacted
70c70
< #root_email = ""
---
> root_email = redacted
81c81,83
< rest_listen_uri = http://127.0.0.1:9000/api/
---
> rest_listen_uri = http://10.20.2.75:9000/api/
90c92
< #rest_transport_uri = http://192.168.1.1:9000/api/
---
> #rest_transport_uri = http://10.20.2.75:9000/api/
135a138,139
> web_listen_uri = http://10.20.2.75:9000/
262c268
< allow_leading_wildcard_searches = false
---
> allow_leading_wildcard_searches = true
266c272
< allow_highlighting = false
---
> allow_highlighting = true
271c277
< #elasticsearch_cluster_name = graylog
---
> elasticsearch_cluster_name = graylog
403c409
< message_journal_dir = data/journal
---
> message_journal_dir = /data/journal
434,435c440,441
< #stream_processing_timeout = 2000
< #stream_processing_max_faults = 3
---
> stream_processing_timeout = 5000
> stream_processing_max_faults = 10
476c482
< #rules_file = /etc/graylog/server/rules.drl
---
> rules_file = /etc/graylog/server/rules.drl
479,488c485,495
< #transport_email_enabled = false
< #transport_email_hostname = mail.example.com
< #transport_email_port = 587
< #transport_email_use_auth = true
< #transport_email_use_tls = true
< #transport_email_use_ssl = true
< #transport_email_auth_username = you@example.com
< #transport_email_auth_password = secret
< #transport_email_subject_prefix = [graylog]
< #transport_email_from_email = graylog@example.com
---
> transport_email_enabled = true
> #transport_email_hostname = redacted
> transport_email_hostname = redacted
> transport_email_port = redacted
> transport_email_use_auth = false
> transport_email_use_tls = false
> transport_email_use_ssl = false
> transport_email_auth_username =
> transport_email_auth_password =
> transport_email_subject_prefix = [graylog]
> transport_email_from_email = redacted
492c499
< #transport_email_web_interface_url = https://graylog.example.com
---
> transport_email_web_interface_url = redacted

Obviously we’re hesitating to do a full production system update.
Thanks


(123dev) #2

Attaching the authorization failure image.
(As a new user I couldn’t attach more than one in the original post)


(Philipp Ruland) #3

Hey @123dev,

are you using the ThreatIntel-Plugin? I just saw this issue on Github after I read your post. https://github.com/Graylog2/graylog-plugin-threatintel/issues/23

This matches your description with the auth problem and the page reload. Maybe @jan can help further since he opened the Github issue :slight_smile:

Greets - Phil


(Lennart Koopmann) #4

Thank you @DerPhlipsi. I am working on a 2.2 compatible version of the plugin.

@123dev Note that other non-official or non-stable plugins might cause similar problems so definitely try if removing those from your plugins folder makes the problem go away.


(123dev) #5

Thank you @DerPhlipsi, that was indeed my issue.
Much appreciate the quick response.

@lennart, I’ll keep that in mind when I encounter unexpected issues.
This issue can now be closed.