Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.33k stars 1.05k forks source link

more details needed for erroneous input data #1504

Open jhaar opened 8 years ago

jhaar commented 8 years ago

Hi there

I'm adding a nxLog connector into graylog-server and got something wrong. Ended up with errors like theses in graylog-server/server.log

2015-10-22T21:50:00.301-04:00 ERROR [DecodingProcessor] Unable to decode raw message 5eee0ca1-7928-11e5-a2e0-005056af12d2 (journal offset 6329293928) encoded as gelf received from /10.3.11.2:55967.
2015-10-22T21:50:00.301-04:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=5eee0ca1-7928-11e5-a2e0-005056af12d2, journalOffset=6329293928, codec=gelf, payloadSize=28, timestamp=2015-10-22T21:50:00.298-04:00, remoteAddress=/10.3.11.2:55967}

It would really help if the srvIP:srvPort were also present in those error messages - otherwise it's really difficult to figure out what is involved in the error (if you accept several Input channels)

eg

2015-10-22T21:50:00.301-04:00 ERROR [DecodingProcessor] Unable to decode raw message 5eee0ca1-7928-11e5-a2e0-005056af12d2 (journal offset 6329293928) encoded as **gelf://ip.of.server:12201/** received from /10.3.11.2:55967.

and

2015-10-22T21:50:00.301-04:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=5eee0ca1-7928-11e5-a2e0-005056af12d2, journalOffset=6329293928, **codec=gelf, proto=tcp, serverAddress=ip.of.server:12201**, payloadSize=28, timestamp=2015-10-22T21:50:00.298-04:00, remoteAddress=/10.3.11.2:55967}

Also if it's gelf vs gelf-TLS that should be portrayed somehow too (although "ip:port" probably does it uniquely enough anyway)

tehpanta commented 8 years ago

I concurr that this feature is something I would really like as well. My server log is being spammed with various errors, but without any indication where the message was from and were it was headed, it is incredibly difficult to troubleshoot anything (I have 20 different inputs opened on my server instance for 10 different project infrastructures).

123dev commented 8 years ago

Ditto