search

Graylog2 / collector-sidecar

Manage log collectors through Graylog
https://www.graylog.org/
Other
268 stars 56 forks source link

No process after graylog-sidecar is running #409

Closed Jawenba closed 3 years ago

Jawenba commented 3 years ago

Problem description

No process after graylog-sidecar is running

Steps to reproduce the problem

service graylog-sidecar status

Stopped

service graylog-sidecar start

Starting graylog-sidecar

service graylog-sidecar status

Running

netstat -na | grep 9000

#

Environment

mpfz0r commented 3 years ago

@Jawenba I can't reproduce that on my setup. The process is running fine. Why do you expect the sidecar to listen on port 9000? That's not what it does.

Does it show up with ps wwaux | grep graylog-sidecar?

Jawenba commented 3 years ago

Becuse API used 9000 port，when graylog-sidecar connects to the server ， listen on port 9000 to be checked the process is OK ? my other servers is ok，only this server is problem. 20210317153351 sidecar UI not find the name xxx-18 server。

here is the log of installing:

# apt-get update && apt-get install graylog-sidecar
Hit:1 http://mirrors.aliyun.com/ubuntu bionic InRelease
Get:2 http://mirrors.aliyun.com/ubuntu bionic-security InRelease [88.7 kB]                                                   
Get:3 http://mirrors.aliyun.com/ubuntu bionic-updates InRelease [88.7 kB]                                                                
Get:4 http://mirrors.aliyun.com/ubuntu bionic-proposed InRelease [242 kB]                                                                       
Get:5 http://mirrors.aliyun.com/ubuntu bionic-backports InRelease [74.6 kB]                                                                     
Get:6 http://mirrors.aliyun.com/ubuntu bionic-security/restricted Sources [18.4 kB]                                                             
Get:7 http://mirrors.aliyun.com/ubuntu bionic-security/restricted amd64 Packages [333 kB]                                                       
Get:8 http://mirrors.aliyun.com/ubuntu bionic-updates/restricted Sources [21.8 kB]                                                              
Get:9 http://mirrors.aliyun.com/ubuntu bionic-updates/restricted amd64 Packages [363 kB]                                                        
Get:10 http://mirrors.aliyun.com/ubuntu bionic-proposed/restricted Sources [13.2 kB]                                                            
Get:11 http://mirrors.aliyun.com/ubuntu bionic-proposed/restricted amd64 Packages [94.5 kB]                                                     
Hit:12 https://packages.graylog2.org/repo/debian sidecar-stable InRelease                                                                   
Err:13 https://artifacts.elastic.co/packages/7.x/apt stable InRelease                                                                           
  Could not wait for server fd - select (11: Resource temporarily unavailable) [IP: 34.120.127.130 443]
Fetched 1338 kB in 31s (43.0 kB/s)                     
Reading package lists... Done
W: Failed to fetch https://artifacts.elastic.co/packages/7.x/apt/dists/stable/InRelease  Could not wait for server fd - select (11: Resource temporarily unavailable) [IP: 34.120.127.130 443]
W: Some index files failed to download. They have been ignored, or old ones used instead.
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following NEW packages will be installed:
  graylog-sidecar
0 upgraded, 1 newly installed, 0 to remove and 108 not upgraded.
Need to get 3331 kB of archives.
After this operation, 8338 kB of additional disk space will be used.
Get:1 https://packages.graylog2.org/repo/debian sidecar-stable/1.1 amd64 graylog-sidecar amd64 1.1.0-1 [3331 kB]
Fetched 3331 kB in 9s (391 kB/s)                                                                                                                
debconf: delaying package configuration, since apt-utils is not installed
Selecting previously unselected package graylog-sidecar.
(Reading database ... 14394 files and directories currently installed.)
Preparing to unpack .../graylog-sidecar_1.1.0-1_amd64.deb ...
Unpacking graylog-sidecar (1.1.0-1) ...
Setting up graylog-sidecar (1.1.0-1) ...
# vi /etc/graylog/sidecar/sidecar.yml 
# The URL to the Graylog server API.
server_url: "http://xxx.xxx.xxx.xxx:9000/api/"

# The API token to use to authenticate against the Graylog server API.
# This field is mandatory
server_api_token: "ig9vqhial2gnpj4dsbcqid2tpeaek62qs4vcp2k0m8og470su16"

# The node ID of the sidecar. This can be a path to a file or an ID string.
# If set to a file and the file doesn't exist, the sidecar will generate an
# unique ID and writes it to the configured path.
#
# Example file path: "file:/etc/graylog/sidecar/node-id"
# Example ID string: "6033137e-d56b-47fc-9762-cd699c11a5a9"
#
# ATTENTION: Every sidecar instance needs a unique ID!
#
#node_id: "file:/etc/graylog/sidecar/node-id"

# The node name of the sidecar. If this is empty, the sidecar will use the
# hostname of the host it is running on.
#node_name: ""

# The update interval in seconds. This configures how often the sidecar will
# contact the Graylog server for keep-alive and configuration update requests.
update_interval: 10

# This configures if the sidecar should skip the verification of TLS connections.
# Default: false
#tls_skip_verify: false

# This enables/disables the transmission of detailed sidecar information like
# collector statues, metrics and log file lists. It can be disabled to reduce
# load on the Graylog server if needed. (disables some features in the server UI)
send_status: true

# A list of directories to scan for log files. The sidecar will scan each
# directory for log files and submits them to the server on each update.
#
# Example:
#     list_log_files:
#       - "/var/log/nginx"
#       - "/opt/app/logs"
"/etc/graylog/sidecar/sidecar.yml" 87L, 3095C written                                                                
# graylog-sidecar -service install
# service graylog-sidecar status
Stopped
# service graylog-sidecar start 
Starting graylog-sidecar
# service graylog-sidecar status
Running
# ps wwaux | grep graylog-sidecar
root      7190  0.0  0.0 1234308 13992 pts/0   Sl   10:37   0:00 /usr/bin/graylog-sidecar
root     10798  0.0  0.0  11464  1040 pts/0    S+   10:37   0:00 grep graylog-sidecar
# netstat -na | grep 9000
# tail -f /var/log/graylog-sidecar/sidecar.log  -n 50 
time="2021-03-16T15:35:54+08:00" level=info msg="Starting signal distributor" 
time="2021-03-17T10:31:44+08:00" level=info msg="Stopping signal distributor" 
time="2021-03-17T10:37:03+08:00" level=info msg="Starting signal distributor" 
^C
malcyon commented 3 years ago

The URL to the Graylog server API. server_url: "http://xxx.xxx.xxx.xxx:9000/api/"

Are the server_url and server_api_token in the config file correct? Is it http when it should be https? Are you able to ping the graylog server from the server the sidecar is on?

I see you included the API key above. You might want to change that. It should be a secret.

Jawenba commented 3 years ago

The config file is correct. I restart the server, the graylog-sidecar service is working. Maybe is the problem of OS. -------- 原始邮件 --------发件人： Donald Morton @.>日期： 2021年3月17日周三 晚上9:18收件人： Graylog2/collector-sidecar @.>抄送： Jawenba @.>, Mention @.>主 题： Re: [Graylog2/collector-sidecar] No process after graylog-sidecar is running (#409)

The URL to the Graylog server API. server_url: "http://xxx.xxx.xxx.xxx:9000/api/"

Are the server_url and server_api_token in the config file correct? Is it http when it should be https? Are you able to ping the graylog server from the server the sidecar is on? I see you included the API key above. You might want to change that. It should be a secret.

—You are receiving this because you were mentioned.Reply to this email directly, view it on GitHub, or unsubscribe.

mpfz0r commented 3 years ago

@Jawenba you could try to run the sidecar in debug mode: /usr/bin/graylog-sidecar -debug

no-response[bot] commented 3 years ago

This issue has been automatically closed because there has been no response to our request for more information from the original author. With only the information that is currently in the issue, we don't have enough information to take action. Please reach out if you have or find the answers we need so that we can investigate further.