Graylog2 / collector-sidecar

Manage log collectors through Graylog
https://www.graylog.org/
Other
268 stars 56 forks source link

update interval > 60 causes server to be marked as inactive #446

Closed chris-y closed 1 year ago

chris-y commented 1 year ago

Problem description

If the update_interval in the sidecar.yml file is set to a value higher than 60, Graylog marks the server as inactive after 60 seconds until the next update.

Graylog should receive the information about how often the server/sidecar sends updates and base the "inactive" flag on that.

Steps to reproduce the problem

  1. Set update_interval: 300
  2. Wait about a minute
  3. Server shows as inactive in the Sidecar area in Graylog until the next update

Environment

thll commented 1 year ago

Hi @chris-y, you can globally configure the threshold that Graylog uses to determine if a sidecar is considered inactive. You can find the setting on the System/Configurations page:

image

If you raise that high enough to cover your largest update interval, it should fix the issue.

This is not a perfect solution if you configure your sidecars to have different update intervals, but in most cases, it should be good enough.

chris-y commented 1 year ago

Hi, yes that has worked, thank you. Is this documented anywhere? As it's a bit hidden away!

thll commented 1 year ago

I think the docs are indeed missing. I've added it to our list of documentation TODO items.