search

Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.41k stars 1.07k forks source link

Invalid GELF type #24

Closed wr0ngway closed 13 years ago

wr0ngway commented 13 years ago

Seeing the below CRITICAL error in my logs, but not sure if I need to do anything about it, and I'm not sure why it has an invalid GELF type. This is from monit log notification to rsyslog that gets forwarded to graylog udp syslog receiver. This happens every time graylog receives that same message (different timestamp).

Thu Feb 10 18:20:37 EST 2011 - INFO - ======= Thu Feb 10 18:20:37 EST 2011 - CRITICAL - Invalid GELF type in message: org.gray log2.messagehandlers.gelf.InvalidGELFTypeException Thu Feb 10 18:20:39 EST 2011 - INFO - Received message: monit[22019]: 'cassandra ' process is not running Thu Feb 10 18:20:39 EST 2011 - INFO - Host: matt Thu Feb 10 18:20:39 EST 2011 - INFO - Facility: 3 (system daemon) Thu Feb 10 18:20:39 EST 2011 - INFO - Level: 3 (Error) Thu Feb 10 18:20:39 EST 2011 - INFO - Raw: <27>Feb 10 18:20:39 matt monit[22019] : 'cassandra' process is not running Thu Feb 10 18:20:39 EST 2011 - INFO - =======

lennartkoopmann commented 13 years ago

It seems like the CRITICAL output is not related to the INFO output. The syslog receiving cannot throw a InvalidGELFTypeException and there is a time gap.

How often does this appear? It seems like something is sending in stuff to your GELF receiver port. If you are not missing messages, you can just ignore it.

Can you find out what is sent in at that point by sniffing the UDP traffic to your GELF port?

wr0ngway commented 13 years ago

You are correct - it happens when I start monit, which checks multiple things, including graylog by trying to connect to the gelf port.