Closed GoogleCodeExporter closed 8 years ago
Sorry to hear you're having troubles. I looked at web.log and don't see a
query actually run. It looks like just the initial page load. Also, when ELSA
installs, it does a quick test and inserts logs that contain the keyword "seq."
If you search for seq, you should get some results. You should delete the
time values in the query for the test to make sure it is searching all time.
Original comment by mchol...@gmail.com
on 24 Mar 2012 at 3:28
When I enter a string for "seq" with no time period, it gave the same query
failed message. I attached the web.log snippet.
Also I checked the database for the "seq." string:
mysql> SELECT * FROM syslogs_index_1 WHERE id=1;
+----+------------+------------+------------+----------+------------------------
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
-----------------------+------+------+------+------+------+------+------+------+
------+------+------+------+
| id | timestamp | host_id | program_id | class_id | msg
| i0 | i1 | i2 | i3 | i4 | i5 | s0 | s1
| s2 | s3 | s4 | s5 |
+----+------------+------------+------------+----------+------------------------
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
-----------------------+------+------+------+------+------+------+------+------+
------+------+------+------+
| 1 | 1332456014 | 2130706433 | 1584708348 | 1 | seq: 0000000000,
runid: 1332456014, stamp: 2012-03-22T16:39:50
PADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADD
PADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPADDPA | NULL | NULL |
NULL | NULL | NULL | NULL | NULL | NULL | NULL | NULL | NULL | NULL |
+----+------------+------------+------------+----------+------------------------
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
-----------------------+------+------+------+------+------+------+------+------+
------+------+------+------+
1 row in set (0.01 sec)
Also, any recommended values for how often to run the cron job that was
installed?
Original comment by kuoti...@gmail.com
on 26 Mar 2012 at 3:49
Attachments:
Your web.log is still not showing an actual query happening. The last thing I
see is a call to "get_previous_queries" but no calls to "query." The data in
the database looks good, but can you make sure that searchd is running? Try
executing this:
mysql -h 127.0.0.1 -P 3307 -e "SELECT * FROM perm_1 WHERE MATCH('seq')"
Original comment by mchol...@gmail.com
on 26 Mar 2012 at 4:27
Here are the relevant processes:
root 2922 1 0 Mar23 ? 00:03:37 /usr/local/sphinx/bin/searchd
--config /usr/local/etc/sphinx.conf
root 3648 2949 0 Mar23 ? 00:00:44 perl
/usr/local/elsa/node/elsa.pl -c /etc/elsa_node.conf
and also:
root 2948 1 0 Mar23 ? 00:00:00 supervising syslog-ng
root 2949 2948 0 Mar23 ? 00:00:14
/usr/local/syslog-ng/sbin/syslog-ng
To get the Web GUI working, I did have to change a few permissions so that
apache can see the files it needs. the system is running in selinux permissive
mode at the moment.
I attached another web.log file after clicking on the drop down menus and
checking on some other functions.
Original comment by kuoti...@gmail.com
on 26 Mar 2012 at 4:44
Attachments:
I did not ask for the processes, I want you to run that query. Also, web.log
still does not show an attempted query. Please do that.
Original comment by mchol...@gmail.com
on 26 Mar 2012 at 5:30
Here is the results from the query:
mysql -h 127.0.0.1 -P 3307 -e "SELECT * FROM perm_1 WHERE MATCH('seq')"
+------+--------+------------+-------+--------+----------+------------+---------
---+----------+---------+---------+---------+---------+---------+---------+-----
----+---------+---------+---------+---------+---------+
| id | weight | timestamp | day | hour | minute | host_id |
program_id | class_id | attr_i0 | attr_i1 | attr_i2 | attr_i3 | attr_i4 |
attr_i5 | attr_s0 | attr_s1 | attr_s2 | attr_s3 | attr_s4 | attr_s5 |
+------+--------+------------+-------+--------+----------+------------+---------
---+----------+---------+---------+---------+---------+---------+---------+-----
----+---------+---------+---------+---------+---------+
| 1 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 3 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 4 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 5 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 6 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 7 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 8 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 9 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 10 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 11 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 12 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 13 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 14 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 15 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 16 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 17 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 18 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 19 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
| 20 | 1501 | 1332456014 | 15422 | 370127 | 22207600 | 2130706433 |
1584708348 | 1 | 0 | 0 | 0 | 0 | 0 |
0 | 0 | 0 | 0 | 0 | 0 | 0 |
+------+--------+------------+-------+--------+----------+------------+---------
---+----------+---------+---------+---------+---------+---------+---------+-----
----+---------+---------+---------+---------+---------+
Original comment by kuoti...@gmail.com
on 26 Mar 2012 at 5:46
Ok, so the backend is fully functional. Can you post a screenshot of putting
"seq" into the web query box?
Original comment by mchol...@gmail.com
on 26 Mar 2012 at 6:30
Here are some trials. I left the time fields blank and did not touch the other
boxes. Same result for both queries.
Original comment by kuoti...@gmail.com
on 26 Mar 2012 at 6:41
Attachments:
Ok, that looks like a query that should be returning the results that we know
Sphinx spits out (as per the mysql command line query you performed). So,
either SELINUX is knocking down your request when running from Apache (test by
setting setenforce 0 and trying), or your /etc/elsa_web.conf file is pointing
to the wrong host.
Original comment by mchol...@gmail.com
on 26 Mar 2012 at 7:11
SELINUX was already set to permissive by setting setenforce 0.
This is what is under nodes in /etc/elsa_web.conf:
"nodes" : {
"127.0.0.1" : {
"db": "syslog",
"username": "elsa",
I've also switched 127.0.0.1 with the fully qualified hostname and got the same
results.
Here's another web.log after a fresh reboot, then submitting a query for "seq".
Thanks for you patience on this btw.
Original comment by kuoti...@gmail.com
on 26 Mar 2012 at 8:42
Attachments:
Happy to help. Still doesn't look like you're getting a query, so let's try
this a bit differently: Do the query directly against the web interface like
this:
http://my.elsa.server.ip/Query/query?q=%7B%22query_string%22%3A%22seq%22%2C%22qu
ery_meta_params%22%3A%7B%22limit%22%3A100%7D%7D
Original comment by mchol...@gmail.com
on 26 Mar 2012 at 8:53
Ok, that gave a 403 Forbidden.
Here is the results in web.log:
* DEBUG [2012/03/26 15:27:16] /usr/local/elsa/web/lib/Web.pm (102)
Web::_extract_method 3665 [undef]
uri: /Query
* DEBUG [2012/03/26 15:27:16] /usr/local/elsa/web/lib/Web/Query.pm (19)
Web::Query::call 3665 [undef]
method: Query
Original comment by kuoti...@gmail.com
on 26 Mar 2012 at 9:33
Ok, that's more helpful. What do you have in /var/log/apache2/error_log (or
whatever error log file this site is going to)?
Original comment by mchol...@gmail.com
on 27 Mar 2012 at 1:24
[deleted comment]
[deleted comment]
Here is the tail of it:
[Mon Mar 26 15:26:08 2012] [error] [client ipaddr] Can't call method "getline"
on unblessed reference at /usr/lib/perl5/site_perl/5.8.8/Plack/Util.pm line
94.\n
[Mon Mar 26 15:26:24 2012] [error] [client ipaddr] Can't call method "getline"
on unblessed reference at /usr/lib/perl5/site_perl/5.8.8/Plack/Util.pm line
94.\n
[Mon Mar 26 15:26:29 2012] [error] [client ipaddr] Can't call method "getline"
on unblessed reference at /usr/lib/perl5/site_perl/5.8.8/Plack/Util.pm line
94.\n
[Mon Mar 26 15:26:43 2012] [error] [client ipaddr] Can't call method "getline"
on unblessed reference at /usr/lib/perl5/site_perl/5.8.8/Plack/Util.pm line
94.\n
...
Prototype mismatch: sub IO::Socket::INET6::PF_INET6 () vs none at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
Constant subroutine IO::Socket::INET6::AF_INET6 redefined at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
Prototype mismatch: sub IO::Socket::INET6::AF_INET6 () vs none at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
Constant subroutine IO::Socket::INET6::PF_INET6 redefined at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
Prototype mismatch: sub IO::Socket::INET6::PF_INET6 () vs none at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
serving from /usr/local/elsa/web/lib../ at /usr/local/elsa/web/lib/Web.psgi
line 67.
serving from /usr/local/elsa/web/lib../ at /usr/local/elsa/web/lib/Web.psgi
line 67.
serving from /usr/local/elsa/web/lib../ at /usr/local/elsa/web/lib/Web.psgi
line 67.
Original comment by kuoti...@gmail.com
on 27 Mar 2012 at 4:42
Are you using IPv6 addresses? Can you show your config (minus passwords, etc.,
of course).
Original comment by mchol...@gmail.com
on 27 Mar 2012 at 5:26
On this machine, I disabled IPv6, you need elsa_web.conf?
Original comment by kuoti...@gmail.com
on 27 Mar 2012 at 6:44
The errors about IO::Socket::INET6::PF_INET6 don't make any sense. Yes, please
include your elsa_web.conf section for nodes.
Original comment by mchol...@gmail.com
on 27 Mar 2012 at 6:50
ok here it is.
Original comment by kuoti...@gmail.com
on 27 Mar 2012 at 7:56
Attachments:
Line 151 shouldn't be commented:
#"127.0.0.1" : {
Original comment by mchol...@gmail.com
on 27 Mar 2012 at 8:01
Oh there is another line with the hostname, which i deleted from this uploaded
file. I can switch it back to 127.0.0.1. I was getting the same results with
both entries.
Original comment by kuoti...@gmail.com
on 27 Mar 2012 at 8:10
ELSA will try to resolve this address, so I recommend using the IP address to
be sure. If it is the localhost, then use 127.0.0.1. Switch back and then
post the error log.
Original comment by mchol...@gmail.com
on 27 Mar 2012 at 8:15
Ok, web.log is attached and here is the tail on httpd:
serving from /usr/local/elsa/web/lib../ at /usr/local/elsa/web/lib/Web.psgi
line 67.
Constant subroutine IO::Socket::INET6::AF_INET6 redefined at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
Prototype mismatch: sub IO::Socket::INET6::AF_INET6 () vs none at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
Constant subroutine IO::Socket::INET6::PF_INET6 redefined at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
Prototype mismatch: sub IO::Socket::INET6::PF_INET6 () vs none at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
serving from /usr/local/elsa/web/lib../ at /usr/local/elsa/web/lib/Web.psgi
line 67.
serving from /usr/local/elsa/web/lib../ at /usr/local/elsa/web/lib/Web.psgi
line 67.
serving from /usr/local/elsa/web/lib../ at /usr/local/elsa/web/lib/Web.psgi
line 67.
serving from /usr/local/elsa/web/lib../ at /usr/local/elsa/web/lib/Web.psgi
line 67.
Original comment by kuoti...@gmail.com
on 27 Mar 2012 at 8:29
Attachments:
And this happens when you use the direct /Query/query URI I provided earlier?
Original comment by mchol...@gmail.com
on 27 Mar 2012 at 8:59
The direct query gave the same 403 error and here is the web.log
Original comment by kuoti...@gmail.com
on 27 Mar 2012 at 9:55
Attachments:
Ok, but when it gives a 403, it means that the web code isn't actually running
so the real error will show up in the Apache error log. Can you post that?
Original comment by mchol...@gmail.com
on 28 Mar 2012 at 1:02
This is the request logged from access.log:
xxx.xxx.xxx.xxx - - [28/Mar/2012:10:16:07 -0600] "GET
/Query/query?q=%7B%22query_string%22%3A%22seq%22%2C%22query_meta_params%22%3A%7B
%22limit%22%3A100%7D%7D HTTP/1.1" 403 213 "-" "Mozilla/4.0 (compatible; MSIE
8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727;
InfoPath.1; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E)"
error_log did not log anything.
Original comment by kuoti...@gmail.com
on 28 Mar 2012 at 6:24
Hm, very surprised there's nothing error_log. Let's try a slightly different
method here.
cd /usr/local/elsa/web/lib && ELSA_CONF=/etc/elsa_web.conf plackup -r Web.psgi
Then run that same GET /Query/query on port 5000 of your ELSA host. Watch the
output from plackup when you do it and look for an error message.
Original comment by mchol...@gmail.com
on 28 Mar 2012 at 6:38
Ok tried this:
# ELSA_CONF=/etc/elsa_web.conf
# plackup -r Web.psgi
Error while loading Web.psgi: No such file or directory at (eval 14) line 4.
Watching ./lib Web.psgi for file updates.
Doesn't look like it started, and I got a connection refused when going to port
5000.
Original comment by kuoti...@gmail.com
on 28 Mar 2012 at 8:21
Ok, you must not be in the right directory. You have to be in the directory
where Web.psgi exists.
Original comment by mchol...@gmail.com
on 28 Mar 2012 at 9:07
Ok, here is the results:
# cd /usr/local/elsa/web/lib
#ELSA_CONF=/etc/elsa_web.conf plackup -r Web.psgi
Watching ./lib Web.psgi for file updates.
Constant subroutine IO::Socket::INET6::AF_INET6 redefined at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
Prototype mismatch: sub IO::Socket::INET6::AF_INET6 () vs none at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
Constant subroutine IO::Socket::INET6::PF_INET6 redefined at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
Prototype mismatch: sub IO::Socket::INET6::PF_INET6 () vs none at
/usr/lib/perl5/5.8.8/Exporter.pm line 65.
at /usr/lib/perl5/vendor_perl/5.8.8/IO/Socket/INET6.pm line 16
serving from /usr/local/elsa/web/lib../ at Web.psgi line 67.
HTTP::Server::PSGI: Accepting connections at http://0:5000/
connecting to 5000 did not log anything and the page didn't serve.
Original comment by kuoti...@gmail.com
on 30 Mar 2012 at 5:52
What do you mean the page didn't serve and nothing was logged? Nothing to the
console, nothing to web.log? And the page was blank, or had an error?
Original comment by mchol...@gmail.com
on 30 Mar 2012 at 6:00
Yes, I tried two things, pointing a webrowser to port 5000 and telneting to the
port and sending "GET
/Query/query?q=%7B%22query_string%22%3A%22seq%22%2C%22query_meta_params%22%3A%7B
%22limit%22%3A100%7D%7D".
Neither logged anything on the console or in weblog. Telnetting to the port
verfied that something is listing on 5000, but nothing to console or web.log
Original comment by kuoti...@gmail.com
on 30 Mar 2012 at 6:18
Before we put anymore effort into it, I will be ceasing work on this project
today, at least for my current employer. But someone may pick it up at a later
time.
Original comment by kuoti...@gmail.com
on 30 Mar 2012 at 6:20
Sorry we couldn't figure this out, but there is something very strange going on
with that box. It still seems like an selinux problem to me, despite
setenforce being zero.
Original comment by mchol...@gmail.com
on 30 Mar 2012 at 6:32
Original comment by mchol...@gmail.com
on 30 Apr 2012 at 2:09
Original issue reported on code.google.com by
kuoti...@gmail.com
on 23 Mar 2012 at 9:57Attachments: