search

Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.33k stars 1.05k forks source link

Illuminate 3.5.0: org.graylog.plugins.illuminate.installation.BundleInstallationException #16302

Closed rkmbaxed closed 1 year ago

rkmbaxed commented 1 year ago

We installed the Illuminate 3.5.0:Juniper SRX Processing Pack. After installing the Processing Pack there was no stream or index for Juniper created. Since this install we are not able to enable any Spotlight and we get an error.

Current Behavior

2023-08-29T12:03:30.596+02:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
org.graylog.plugins.illuminate.installation.BundleInstallationException: Encountered an unhandled exception during installation: Cannot load user <admin> from db
    at org.graylog.plugins.illuminate.installation.BundleInstallationException.unhandled(BundleInstallationException.java:66) ~[?:?]
    at org.graylog.plugins.illuminate.installation.BundleInstaller.installBundle(BundleInstaller.java:170) ~[?:?]
    at org.graylog.plugins.illuminate.bundle.BundleManagementService.lambda$installPacksForBundle$9(BundleManagementService.java:373) ~[?:?]
    at org.graylog.plugins.illuminate.bundle.BundleManagementService.suspendProcessingAndExecute(BundleManagementService.java:392) ~[?:?]
    at org.graylog.plugins.illuminate.bundle.BundleManagementService.installPacksForBundle(BundleManagementService.java:363) ~[?:?]
    at org.graylog.plugins.illuminate.rest.BundleManagementResource.managePacks(BundleManagementResource.java:179) ~[?:?]
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?]
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?]
    at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?]
    at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:134) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:177) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:81) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:400) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:81) ~[graylog.jar:?]
    at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:255) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:292) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:274) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:244) [graylog.jar:?]
    at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265) [graylog.jar:?]
    at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:234) [graylog.jar:?]
    at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:684) [graylog.jar:?]
    at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:356) [graylog.jar:?]
    at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:200) [graylog.jar:?]
    at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?]
    at java.lang.Thread.run(Thread.java:833) [?:?]
Caused by: org.graylog.plugins.illuminate.installation.BundleInstallationException: Failed to install bundle.
    at org.graylog.plugins.illuminate.installation.BundleInstallationException.installationFailed(BundleInstallationException.java:19) ~[?:?]
    at org.graylog.plugins.illuminate.installation.BundleInstaller.installSpotlightPacks(BundleInstaller.java:301) ~[?:?]
    at org.graylog.plugins.illuminate.installation.BundleInstaller.installBundle(BundleInstaller.java:154) ~[?:?]
    ... 31 more
Caused by: org.graylog2.contentpacks.exceptions.ContentPackException: Failed to install content pack <227410db-a89b-49e5-9970-7d3a98c22bf3/1>
    at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:161) ~[graylog.jar:?]
    at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:102) ~[graylog.jar:?]
    at org.graylog.plugins.illuminate.installation.IlluminateContentPackInstaller.install(IlluminateContentPackInstaller.java:68) ~[?:?]
    at org.graylog.plugins.illuminate.installation.BundleInstaller.installSpotlightPacks(BundleInstaller.java:282) ~[?:?]
    at org.graylog.plugins.illuminate.installation.BundleInstaller.installBundle(BundleInstaller.java:154) ~[?:?]
    ... 31 more
Caused by: java.lang.IllegalStateException: Cannot load user <admin> from db
    at org.graylog2.contentpacks.facades.ViewFacade.lambda$createNativeEntity$1(ViewFacade.java:126) ~[graylog.jar:?]
    at java.util.Optional.orElseThrow(Optional.java:403) ~[?:?]
    at org.graylog2.contentpacks.facades.ViewFacade.createNativeEntity(ViewFacade.java:126) ~[graylog.jar:?]
    at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:152) ~[graylog.jar:?]
    at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:102) ~[graylog.jar:?]
    at org.graylog.plugins.illuminate.installation.IlluminateContentPackInstaller.install(IlluminateContentPackInstaller.java:68) ~[?:?]
    at org.graylog.plugins.illuminate.installation.BundleInstaller.installSpotlightPacks(BundleInstaller.java:282) ~[?:?]
    at org.graylog.plugins.illuminate.installation.BundleInstaller.installBundle(BundleInstaller.java:154) ~[?:?]
    ... 31 more

Possible Solution

Steps to Reproduce (for bugs)

  1. Enable Illuminate 3.5.0:Juniper SRX
  2. Enable Illuminate 3.5.0:Juniper SRX Spotlight
  3. Enable any other Spotlight Package

Context

Your Environment

bernd commented 1 year ago

@Graylog2/seccon Please check if this is fixed with Illuminate 3.5.1. Thanks!

rkmbaxed commented 1 year ago

I tested it this morning with v3.5.1, the index "Juniper Logs" and the stream "Illuminate:Juniper Messages" are now created, but we are still not able to activate a content pack / spotlight package.

2023-09-05T08:04:51.578+02:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource org.graylog.plugins.illuminate.installation.BundleInstallationException: Encountered an unhandled exception during installation: Cannot load user <admin> from db at org.graylog.plugins.illuminate.installation.BundleInstallationException.unhandled(BundleInstallationException.java:66) ~[?:?] at org.graylog.plugins.illuminate.installation.BundleInstaller.installBundle(BundleInstaller.java:170) ~[?:?] at org.graylog.plugins.illuminate.bundle.BundleManagementService.lambda$installPacksForBundle$9(BundleManagementService.java:373) ~[?:?] at org.graylog.plugins.illuminate.bundle.BundleManagementService.suspendProcessingAndExecute(BundleManagementService.java:392) ~[?:?] at org.graylog.plugins.illuminate.bundle.BundleManagementService.installPacksForBundle(BundleManagementService.java:363) ~[?:?] at org.graylog.plugins.illuminate.rest.BundleManagementResource.managePacks(BundleManagementResource.java:179) ~[?:?] at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?] at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[?:?] at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:?] at java.lang.reflect.Method.invoke(Method.java:568) ~[?:?] at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) ~[graylog.jar:?] at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:134) ~[graylog.jar:?] at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:177) ~[graylog.jar:?] at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219) ~[graylog.jar:?] at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:81) ~[graylog.jar:?] at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478) ~[graylog.jar:?] at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:400) ~[graylog.jar:?] at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:81) ~[graylog.jar:?] at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:255) [graylog.jar:?] at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) [graylog.jar:?] at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) [graylog.jar:?] at org.glassfish.jersey.internal.Errors.process(Errors.java:292) [graylog.jar:?] at org.glassfish.jersey.internal.Errors.process(Errors.java:274) [graylog.jar:?] at org.glassfish.jersey.internal.Errors.process(Errors.java:244) [graylog.jar:?] at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:265) [graylog.jar:?] at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:234) [graylog.jar:?] at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:684) [graylog.jar:?] at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:356) [graylog.jar:?] at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:200) [graylog.jar:?] at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) [?:?] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) [?:?] at java.lang.Thread.run(Thread.java:833) [?:?] Caused by: org.graylog.plugins.illuminate.installation.BundleInstallationException: Failed to install bundle. at org.graylog.plugins.illuminate.installation.BundleInstallationException.installationFailed(BundleInstallationException.java:19) ~[?:?] at org.graylog.plugins.illuminate.installation.BundleInstaller.installSpotlightPacks(BundleInstaller.java:301) ~[?:?] at org.graylog.plugins.illuminate.installation.BundleInstaller.installBundle(BundleInstaller.java:154) ~[?:?] ... 31 more Caused by: org.graylog2.contentpacks.exceptions.ContentPackException: Failed to install content pack <8b520b7d-c95d-46ac-8807-652e2b658e23/1> at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:161) ~[graylog.jar:?] at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:102) ~[graylog.jar:?] at org.graylog.plugins.illuminate.installation.IlluminateContentPackInstaller.install(IlluminateContentPackInstaller.java:68) ~[?:?] at org.graylog.plugins.illuminate.installation.BundleInstaller.installSpotlightPacks(BundleInstaller.java:282) ~[?:?] at org.graylog.plugins.illuminate.installation.BundleInstaller.installBundle(BundleInstaller.java:154) ~[?:?] ... 31 more Caused by: java.lang.IllegalStateException: Cannot load user <admin> from db at org.graylog2.contentpacks.facades.ViewFacade.lambda$createNativeEntity$1(ViewFacade.java:126) ~[graylog.jar:?] at java.util.Optional.orElseThrow(Optional.java:403) ~[?:?] at org.graylog2.contentpacks.facades.ViewFacade.createNativeEntity(ViewFacade.java:126) ~[graylog.jar:?] at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:152) ~[graylog.jar:?] at org.graylog2.contentpacks.ContentPackService.installContentPack(ContentPackService.java:102) ~[graylog.jar:?] at org.graylog.plugins.illuminate.installation.IlluminateContentPackInstaller.install(IlluminateContentPackInstaller.java:68) ~[?:?] at org.graylog.plugins.illuminate.installation.BundleInstaller.installSpotlightPacks(BundleInstaller.java:282) ~[?:?] at org.graylog.plugins.illuminate.installation.BundleInstaller.installBundle(BundleInstaller.java:154) ~[?:?] ... 31 more

miwent commented 1 year ago

I tested it this morning with v3.5.1, the index "Juniper Logs" and the stream "Illuminate:Juniper Messages" are now created, but we are still not able to activate a content pack / spotlight package.

By any chance did you change the root_username setting in your Graylog server.conf file from the default?

rkmbaxed commented 1 year ago

By any chance did you change the root_username setting in your Graylog server.conf file from the default?

For sure, we changed it for compliance reasons. So far there were no problems with renaming the value for root_username. But I understand where your question is coming from. We will reset it to the default value and then test again if the problem persists.

rkmbaxed commented 1 year ago

I can confirm that when the key root_username is set to the default value again the problem does not persist.

But that can't be the solution to the problem, right? There is a reason why the key is configurable and it must work with the database.

ryan-carroll-graylog commented 1 year ago

@rkmbaxed thank you for confirming, and yes this is a bug. We have a fix PR currently in review. Thank you for pointing this issue out.

In the mean time the first work around is, as noted, using the default of admin for root_username. Once installed and activated you can switch the root_username back and the content should continue to work normally.

A second work around is to:

  1. Enable the Illuminate Spotlight pack from the Illuminate page (you see the noted error).
  2. Navigate to System > Content Packs and manually install the associated Content Pack (e.g. Graylog Illuminate:Juniper SRX Spotlight) Note: This will only work install the spotlight content (searches/dashboards etc), so the Streams and Indices will need to have installed correctly as mentioned in your second comment.
miwent commented 1 year ago

I can confirm that when the key root_username is set to the default value again the problem does not persist.

But that can't be the solution to the problem, right? There is a reason why the key is configurable and it must work with the database.

This is a temporary solution, after making changes to Illuminate you should be able to set this back. This is being addressed in an upcoming release.