airpwn / enterprise-log-search-and-archive

Automatically exported from code.google.com/p/enterprise-log-search-and-archive
0 stars 0 forks source link

Unable to query more than 6 hours before #194

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago
Hello,

Everything looks just fine, but when I do any kind of query with more than 
06:05 I receive the following error:

"Invalid query result"

I've tried to look at the logs files but could not see anything that I think 
it's relevant.

Facts:

1 node(s) with 95.5 million logs indexed and 1.2 billion archived

Thanks,

João Domingues

I've attached an excerpt from my web.log

Original issue reported on code.google.com by joao.dom...@gmail.com on 13 Feb 2014 at 4:22

Attachments:

GoogleCodeExporter commented 9 years ago
I meant 6 hours and 5 minutes...

Original comment by joao.dom...@gmail.com on 14 Feb 2014 at 12:46

GoogleCodeExporter commented 9 years ago
It thinks it needs to do an archive query, and that is failing for some reason. 
Are there any errors in your /var/log/apache2/error_log file indicating 
something going wrong with the query?

When you hover over the "start" field, what are the earliest times shown for 
archive and index?

Original comment by mchol...@gmail.com on 19 Feb 2014 at 5:34

GoogleCodeExporter commented 9 years ago
These are the only results in my error_log file:

Use of uninitialized value in pattern match (m//) at 
/usr/local/elsa/web/lib/User.pm line 552.
Use of uninitialized value in hash element at /usr/local/elsa/web/lib/User.pm 
line 560.
Use of uninitialized value in localtime at 
/usr/local/elsa/web/lib/QueryParser.pm line 440.
Use of uninitialized value in concatenation (.) or string at 
/usr/local/elsa/web/lib/QueryParser.pm line 440.

When I hover over the "start" field I get:

"Earliest: 2014-02-20 18:21:03, Archive Earliest: 2014-02-14 12:37:11"

Now is 2014-02-21 12:20:00, what I think is very strange is this, if I refresh 
the page i should get today's date and now time, but i always get, 2 days ago 
date and now time. My server clock is correct, I have ntp protocol configured...

Original comment by joao.dom...@gmail.com on 21 Feb 2014 at 12:29

GoogleCodeExporter commented 9 years ago
Hello!
I'm sorry for being a pain, but the issue continues and i can't find what 
happened here.
Thanks,

Original comment by joao.dom...@gmail.com on 6 Mar 2014 at 5:30

GoogleCodeExporter commented 9 years ago
With last update the problem seems to be solved! :)

Original comment by joao.dom...@gmail.com on 12 Mar 2014 at 4:47