We’re getting unexpected WhoisIpLookup errors that only occur on whatever pod is master. We tried making a new pod master and the problem went to the new pod. We tried disabling all calls to it in our pipeline rules and yet the errors persist. The strange part is that it is not attempting to lookup …

Hey @amunoz Correct me if im wrong , but that plugin looks to old for the version of Graylog you have. you should see something liek this under System/Nodes. mine is older but they should match your version of Graylog being 5.1.x. [image]

Thanks for the response @gsmith Looks like Threat Intelligence Plugin is also 5.1.2. The version I posted was showing that it met the constraints. My apologies. [image]

Edited the post to add that we removed all pipelines, all inputs, and we are still getting the error in the logs.

We’re also seeing this which may or may not be related: [image] Recurring error every 30 seconds: [IndexerClusterCheckerThread] - Error while trying to check Elasticsearch disk usage Graylog Central (peer support) Every 30 seconds on the dot we are getting the following er…

We found the problem here. It ended up being an Event that was doing a whois and passing in the message.

WhoisIpLookup (Threat Intel) errors but only on master pod

Graylog Central (peer support)

amunoz (Alex) June 29, 2023, 8:45pm 5

We’re also seeing this which may or may not be related:

Topic		Replies	Views
Whois Plugin not working Graylog Add-ons pipeline-rules	3	2702	April 21, 2020
"who is" not working for many ips Graylog Central (peer support)	7	1439	March 6, 2019
Whois plugin looking up RFC1918 addresses Graylog Add-ons pipeline-rules	12	3777	January 7, 2019
Generic "could not lookup WHOIS" Graylog Add-ons	3	1680	September 11, 2017
Issue with AzureAD Pipeline Rule - Client IP for Map Graylog Central (peer support) pipeline-rules , route-to-streampl	11	822	December 14, 2022

WhoisIpLookup (Threat Intel) errors but only on master pod

Related topics