This looks like a bug to me but what do you think?
It's the Graylog 1.3 Docker image, running with this command:
docker run -t \
--rm \
-p 9000:9000 \
-p 1514:1514/udp \
-p 12201:12201 \
-e GRAYLOG_TIMEZONE=EST5EDT \
-e GRAYLOG_RETENTION="--time=24 --indices=90" \
-e GRAYLOG_NODE_ID=redacted \
-e GRAYLOG_SERVER_SECRET=redacted \
-v /graylog/data:/var/opt/graylog/data \
-v /graylog/logs:/var/log/graylog \
graylog2/allinone
I'm using docker logs --follow to monitor it. About 7:30 last night the
message count in graylog went over 1000 per second with errors from
graylog-server and the log is constantly getting this error. After the
error is one of the messages from my server which I redacted:
2015-12-17_03:19:08.37179 Privileges: SeSecurityPrivilege |
ThreadID: 7072 | EventID: 4672 | _id: ef57cc81-a46c-11e5-85f7-0242ac110002
| RecordNumber: 39475793 | SubjectUserSid:
S-1-5-21-602162358-1284227242-1801674531-3790 }, messages=null}, sequence
211560
2015-12-17_03:19:08.37370 java.lang.IncompatibleClassChangeError: Class
java.lang.Class does not implement the requested interface
com.google.common.cache.LocalCache$ValueReference
2015-12-17_03:19:08.37478 at
com.google.common.cache.LocalCache$LoadingValueReference.get(LocalCache.java:3562)
2015-12-17_03:19:08.37605 at
com.google.common.cache.LocalCache$Segment.getLiveValue(LocalCache.java:2740)
2015-12-17_03:19:08.37920 at
com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2183)
2015-12-17_03:19:08.38246 at
com.google.common.cache.LocalCache.get(LocalCache.java:3937)
2015-12-17_03:19:08.38681 at
com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
2015-12-17_03:19:08.38848 at
org.graylog2.filters.ExtractorFilter.loadExtractors(ExtractorFilter.java:74)
2015-12-17_03:19:08.39095 at
org.graylog2.filters.ExtractorFilter.filter(ExtractorFilter.java:60)
2015-12-17_03:19:08.39215 at
org.graylog2.buffers.processors.ServerProcessBufferProcessor.handleMessage(ServerProcessBufferProcessor.java:97)
2015-12-17_03:19:08.39491 at
org.graylog2.shared.buffers.processors.ProcessBufferProcessor.dispatchMessage(ProcessBufferProcessor.java:82)
2015-12-17_03:19:08.39550 WARN [ProcessBuffer] Unable to process event
MessageEvent{raw=null, redacted
I'm still able to search however and things seem to otherwise be working.
Before I restart the container, any suggestions?
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/331bfab3-40c8-4b71-bbf4-f1487cd07925%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
