While rendering this widget, the following error occurred: NotFoundError: Failed to execute 'removeChild' on 'Node': The node to be removed is not a child of this node

Graylog Central (peer support)
1

Graylog Version: 3.3.5+6436f1b
Platform: Docker utilising docker-compose
Browers: Chromium-based browsers (Google Chrome Version 85.0.4183.83, Microsoft Edge Version 87.0.634.0 canary (64-bit))

Issues Summary:

When browsing content and open messages using the ‘All Messages’ widget I receive the following error:

    While rendering this widget, the following error occurred:

    * NotFoundError: Failed to execute 'removeChild' on 'Node': The node to be removed is not a child of this node

Initial Investigation

This does not occur all the time; I’ve not been able to piece together any correlation yet between message or actions taken.

This issue appears to be present in Chromium-based browsers.
The issue is not present when using Microsoft Edge 44.20206.1000.0

At first, I thought this was related to an invalid certificate chain, but I’ve now added the intermediate certificates to the Keystore resolving one matter but not this matter.

The output from the browser console:

vendor.043dd426065882df527b.js:26 DOMException: Failed to execute 'removeChild' on 'Node': The node to be removed is not a child of this node.
    at ls (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:86666)
    at pc (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:99855)
    at exports.unstable_runWithPriority (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:42:3988)
    at Xo (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:45021)
    at fc (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:97715)
    at Qs (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:93869)
    at https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:45312
    at exports.unstable_runWithPriority (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:42:3988)
    at Xo (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:45021)
    at Ko (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:45257)
    at Uo (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:45192)
    at D (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:114341)
    at Vt (https://graylog.int.example.com/assets/vendor.043dd426065882df527b.js:26:22722)
es @ vendor.043dd426065882df527b.js:26

Docker Compose File:

version: '3.2'
services:
  # MongoDB: https://hub.docker.com/_/mongo/
  mongo:
    image: mongo:3
    restart: unless-stopped
    volumes:
      - mongo_data:/data/db
    networks:
      - graylog
  # Elasticsearch: https://www.elastic.co/guide/en/elasticsearch/reference/6.x/docker.html
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:6.8.5
    restart: unless-stopped
    volumes:
      - es_data:/usr/share/elasticsearch/data
    environment:
      - http.host=0.0.0.0
      - transport.host=localhost
      - network.host=0.0.0.0
      - "ES_JAVA_OPTS=-Xms1024m -Xmx1024m"
    ulimits:
      memlock:
        soft: -1
        hard: -1
#    mem_limit: 1g
    networks:
      - graylog
  # Graylog: https://hub.docker.com/r/graylog/graylog/
  graylog:
    image: graylog/graylog:3.3
    volumes:
      - graylog_journal:/usr/share/graylog/data/journal
    restart: unless-stopped
    networks:
      - graylog
    depends_on:
      - mongo
      - elasticsearch
    environment:
      GRAYLOG_SERVER_JAVA_OPTS: "-Djavax.net.ssl.trustStore=/usr/share/graylog/data/config/ssl/cacerts.jks"

    ports:
      # Graylog https and Rest API
      - 443:443
      #- 127.0.0.1:9000:9000
      # Syslog TCP
      - 514:514
      # Syslog UDP
      - 514:514/udp
      # Syslog UDP for Linux Hosts
      - 1514:1514/udp
      # GELF TCP
      - 12201:12201
      # GELF UDP
      - 12201:12201/udp
    logging:
      driver: "json-file"

    volumes:
      # Mount local configuration directory into Docker container
      - ./graylog/config:/usr/share/graylog/data/config
      # Mount GEO Database DIR
      - ./graylog/geoip:/usr/share/graylog/data/geoip
      # Mount local plugin files into Docker container
      #- ./graylog/plugin/graylog-plugin-auth-sso-3.3.0.jar:/usr/share/graylog/plugin/graylog-plugin-auth-sso-3.3.0.jar
      - ./graylog/plugin/graylog-plugin-enterprise-3.3.2.jar:/usr/share/graylog/plugin/graylog-plugin-enterprise-3.3.2.jar
      # Mount local graylog binaires files into Docker container
      - ./graylog/bin/chromedriver:/usr/share/graylog/bin/chromedriver
      - ./graylog/bin/chromedriver_start.sh:/usr/share/graylog/bin/chromedriver_start.sh
      - ./graylog/bin/headless_shell:/usr/share/graylog/bin/headless_shell

volumes:
  mongo_data:
    driver: local
  es_data:
    driver: local
  graylog_journal:
    driver: local

networks:
  graylog:

Any Assistance

Can someone point me in the right direction, allowing me to debug the issue further?

2

Hello @tomehb, welcome!

The formatting and detail in this post are fantastic.

Has the deployment changed in any way recently? Have any elements been upgraded recently, specifically Graylog server itself? Does it occur specifically when you expand a message to examine it, or can it occur only when you are browsing the stream without expanding a message?

3

Hi Andrew,

Thank you!

I’ve only started to notice the issue once I started to use the system which was fairly recently (last 2 weeks), prior to this it was installed(2 months) but I did not expand messages.

The deployment has not changed substantially lately, other than keeping it up to date with the latest releases.

On the setup I’ve got three seperate inputs being:

  • GELF UDP
  • Syslog UDP (1514)
  • Syslog UDP (514)

On messages received via the GELF UDP Input I don’t appear to experience the issue.

On the other two inputs I do experience this issue; these also have simple pipelines attached to them to lookup data utilising lookup tables from another source.

It the issue occurs when

  • expanding a message within the browser (most common)
  • sometimes when clicking the green search icon, to perform a search

The issue does not occur when (does not appear too)

  • searching old data, such as data from the previous day

Do you think it may be something in the data being displayed when expanded? I’ve attempted to use the DevTools within the browser but cannot figure out the cause.

4

Hello @tomehb,

Yes, I was thinking that for some reason the view can’t be rendered correctly, maybe due to some kind of formatting/unsanitized data especially since your thorough investigation revealed it to appear to only affect Chromium-based browsers. Are you by chance running the browsers in an extremely restricted setting, where all of the elements of the view may not be rendered correctly due to permissions?

5

Hi Andrew,

Not restricted in anyway on either machines (all Windows OS) with full Admin privileges.

I guess I can start by cutting down the data I am inserting in my lookups in attempt to identify if any of the data being displayed is causing the issue.

I tried using the Dev Tools within the browser to troubleshoot the js, but sadly got a little lost by all the short variable names and identifying the element that causes the error.

Thanks
Tom

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.