Seems my conclusion was a bit hasty. The background is a vendor starting the output with a length, followed by repository and then structured csv. >From that, the following (shortened) would trigger the stack trace: "123 test" After testing "1test" with nothing showing up in graylog, I assumed that it also triggered the error, and same with "123" leading me to believe that the starting int was the culprit. It seems though, that this is not the case, as those inputs does NOT trigger the stack trace, but they does not show up in graylog either. Hope this clarifies a bit.
-thePretender On Friday, February 19, 2016 at 6:06:58 PM UTC+1, Jochen Schalanda wrote: > > Hi, > > that's probably because the heuristics in the Graylog Syslog TCP input is > trying to use octet counting (see > https://tools.ietf.org/html/rfc5425#section-4.3 and > https://tools.ietf.org/html/rfc6587#section-3.4.1) in those syslog > messages to determine their length. > > Could you please provide some examples of those syslog messages which > trigger this error? > > > Cheers, > Jochen > > On Thursday, 18 February 2016 16:26:23 UTC+1, thePretender wrote: >> >> Hey, >> Encountered a rather strange issue. If a number is the first character >> parsed by a syslog tcp input, the following exception is thrown. However, >> sending the same input to a syslog UDP input works fine. >> >> 2016-02-18 15:19:28,898 ERROR: >> org.graylog2.plugin.inputs.transports.NettyTransport - Error on Input >> [Syslog TCP/56c5c485c2dc44d0b90ad60c] (channel [id: 0xa83b6845, >> /10.0.xxx.xxx:44304 :> /10.0.xxx.xxx:5142]) >> java.lang.NumberFormatException: For input string: "1/1 >> yYb_yvcQTzqQzSDdeBAOqQ >> default >> {"_counter":1,"_type_str":"msg" >> at >> java.lang.NumberFormatException.forInputString(NumberFormatException.java:65) >> >> ~[?:1.8.0_71] >> at java.lang.Integer.parseInt(Integer.java:580) ~[?:1.8.0_71] >> at java.lang.Integer.parseInt(Integer.java:615) ~[?:1.8.0_71] >> at >> org.graylog2.inputs.syslog.tcp.SyslogOctetCountFrameDecoder.decode(SyslogOctetCountFrameDecoder.java:44) >> >> ~[graylog.jar:?] >> at >> org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425) >> >> ~[graylog.jar:?] >> at >> org.jboss.netty.handler.codec.frame.FrameDecoder.cleanup(FrameDecoder.java:482) >> >> ~[graylog.jar:?] >> at >> org.jboss.netty.handler.codec.frame.FrameDecoder.channelDisconnected(FrameDecoder.java:365) >> >> ~[graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:102) >> >> ~[graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.channelDisconnected(SimpleChannelUpstreamHandler.java:208) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:102) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.channelDisconnected(SimpleChannelHandler.java:199) >> >> [graylog.jar:?] >> at >> org.graylog2.plugin.inputs.util.ConnectionCounter.channelDisconnected(ConnectionCounter.java:55) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:120) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.channelDisconnected(SimpleChannelHandler.java:199) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:120) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.channelDisconnected(SimpleChannelUpstreamHandler.java:208) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:102) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.channelDisconnected(SimpleChannelUpstreamHandler.java:208) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:102) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.Channels.fireChannelDisconnected(Channels.java:396) >> [graylog.jar:?] >> at >> org.jboss.netty.channel.socket.nio.AbstractNioWorker.close(AbstractNioWorker.java:360) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.socket.nio.NioServerSocketPipelineSink.handleAcceptedSocket(NioServerSocketPipelineSink.java:81) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.socket.nio.NioServerSocketPipelineSink.eventSunk(NioServerSocketPipelineSink.java:36) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendDownstream(DefaultChannelPipeline.java:779) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.closeRequested(SimpleChannelHandler.java:334) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.handleDownstream(SimpleChannelHandler.java:260) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:591) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendDownstream(DefaultChannelPipeline.java:784) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.closeRequested(SimpleChannelHandler.java:334) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.handleDownstream(SimpleChannelHandler.java:260) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:591) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendDownstream(DefaultChannelPipeline.java:784) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.closeRequested(SimpleChannelHandler.java:334) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.handleDownstream(SimpleChannelHandler.java:260) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:591) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendDownstream(DefaultChannelPipeline.java:582) >> >> [graylog.jar:?] >> at org.jboss.netty.channel.Channels.close(Channels.java:812) >> [graylog.jar:?] >> at >> org.jboss.netty.channel.AbstractChannel.close(AbstractChannel.java:206) >> [graylog.jar:?] >> at >> org.graylog2.plugin.inputs.transports.NettyTransport$RawMessageHandler.exceptionCaught(NettyTransport.java:347) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:130) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.handler.codec.frame.FrameDecoder.exceptionCaught(FrameDecoder.java:377) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:112) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.exceptionCaught(SimpleChannelUpstreamHandler.java:153) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:112) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.exceptionCaught(SimpleChannelHandler.java:156) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:130) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.exceptionCaught(SimpleChannelHandler.java:156) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:130) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.exceptionCaught(SimpleChannelUpstreamHandler.java:153) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:112) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.exceptionCaught(SimpleChannelUpstreamHandler.java:153) >> >> [graylog.jar:?] >> at >> org.graylog2.plugin.inputs.transports.NettyTransport$2$1.exceptionCaught(NettyTransport.java:204) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:112) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.Channels.fireExceptionCaught(Channels.java:525) >> [graylog.jar:?] >> at >> org.jboss.netty.channel.AbstractChannelSink.exceptionCaught(AbstractChannelSink.java:48) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.notifyHandlerException(DefaultChannelPipeline.java:658) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:566) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.graylog2.inputs.syslog.tcp.SyslogTCPFramingRouterHandler.messageReceived(SyslogTCPFramingRouterHandler.java:53) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.messageReceived(SimpleChannelHandler.java:142) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:88) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.handler.traffic.AbstractTrafficShapingHandler.messageReceived(AbstractTrafficShapingHandler.java:718) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:88) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.messageReceived(SimpleChannelUpstreamHandler.java:124) >> >> [graylog.jar:?] >> at >> org.graylog2.plugin.inputs.util.PacketInformationDumper.messageReceived(PacketInformationDumper.java:73) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.messageReceived(SimpleChannelUpstreamHandler.java:124) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268) >> [graylog.jar:?] >> at >> org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255) >> [graylog.jar:?] >> at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88) >> [graylog.jar:?] >> at >> org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337) >> >> [graylog.jar:?] >> at >> org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89) >> >> [graylog.jar:?] >> at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178) >> [graylog.jar:?] >> at >> org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) >> >> [graylog.jar:?] >> at >> org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) >> >> [graylog.jar:?] >> at >> com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) >> >> [graylog.jar:?] >> at >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) >> >> [?:1.8.0_71] >> at >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) >> >> [?:1.8.0_71] >> at java.lang.Thread.run(Thread.java:745) [?:1.8.0_71] >> >> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/0b714777-513b-41c2-a22d-4bbd18ee4ede%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
