We’re getting unexpected WhoisIpLookup errors that only occur on whatever pod is master. We tried making a new pod master and the problem went to the new pod. We tried disabling all calls to it in our pipeline rules and yet the errors persist. The strange part is that it is not attempting to lookup …

WhoisIpLookup (Threat Intel) errors but only on master pod

amunoz (Alex) June 29, 2023, 8:45pm 5

We’re also seeing this which may or may not be related:

Topic		Replies	Views
Whois plugin looking up RFC1918 addresses Graylog Add-ons pipeline-rules	12	3364	January 7, 2019
Trying to get the Open Threat Exchange - Threat intel plugin working on a Graylog Graylog Central (peer support) pipeline-rules	10	1244	June 25, 2021
Pipeline whoislookup Debug not workind Graylog Central (peer support) pipeline-rules , debuggingpl	7	1123	November 21, 2018
Whois o DNS resolution on IP's inside the log message Graylog Central (peer support)	5	1778	December 27, 2018
Graylog Threat Intel Plugin Results - Stuck in Tail cave Graylog Central (peer support) pipeline-rules	6	1657	June 29, 2020