Done - Two tickets created. On Thursday, June 23, 2016 at 2:26:47 PM UTC-4, Jan Doberstein wrote: > > Hej SHon, > > all what you describe looks like a bug, can you please open a ticket > https://github.com/Graylog2/graylog2-server/issues that the issue can > be fixed. > > thank you > Jan > > > On 23. Juni 2016 at 19:11:37, Shon Nixon ([email protected] <javascript:>) > wrote: > > Decided to run nxlog solo with the correct information and still get the > > same problem: > > > > > > 2016-06-23T12:58:18.248-04:00 ERROR [GelfCodec] Could not parse JSON, > first > > 400 characters: `�)�V���C� > > > > �a?�n > > �n�r��埯o����}ۍvdY>_"~g��rgИ:� > > com.fasterxml.jackson.core.JsonParseException: Unexpected character ('`' > > (code 96)): expected a valid value (number, String, array, object, > 'true', > > 'false' or 'null') > > at [Source: `�)�V���C� > > �a?�n > > �n�r��埯o����}ۍvdY>_"~g��rgИ:�; line: 1, column: 2] > > at > > > com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1581) > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:533) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.base.ParserMinimalBase._reportUnexpectedChar(ParserMinimalBase.java:462) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1624) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:689) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3771) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3716) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2272) > > > ~[graylog.jar:?] > > at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:115) > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:136) > > > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:82) > > > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58) > > > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35) > > > > [graylog.jar:?] > > at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:139) > > [graylog.jar:?] > > at > > > com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) > > > > [graylog.jar:?] > > at java.lang.Thread.run(Thread.java:745) [?:1.8.0_73] > > 2016-06-23T12:58:18.253-04:00 ERROR [DecodingProcessor] Unable to decode > > raw message af0450e2-3963-11e6-ae65-005056937893 (journal offset > 84466333) > > encoded as gelf received from /10.100.150.89:34338. > > > > > > > > Then took HAProxy out of the picture and pushed to one of the servers > > directly and STILL get the same problem: > > > > > > 2016-06-23T13:01:41.359-04:00 ERROR [GelfCodec] Could not parse JSON, > first > > 400 characters: �p]3 > > b�Q��F!��0�и > > i�D�� > > com.fasterxml.jackson.core.JsonParseException: Unexpected character ('�' > > (code 65533 / 0xfffd)): expected a valid value (number, String, array, > > object, 'true', 'false' or 'null') > > at [Source: �p]3 > > b�Q��F!��0�и > > i�D��; line: 1, column: 2] > > at > > > com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1581) > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:533) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.base.ParserMinimalBase._reportUnexpectedChar(ParserMinimalBase.java:462) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1624) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:689) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3771) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3716) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2272) > > > ~[graylog.jar:?] > > at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:115) > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:136) > > > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:82) > > > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58) > > > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35) > > > > [graylog.jar:?] > > at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:139) > > [graylog.jar:?] > > at > > > com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) > > > > [graylog.jar:?] > > at java.lang.Thread.run(Thread.java:745) [?:1.8.0_73] > > 2016-06-23T13:01:41.359-04:00 ERROR [DecodingProcessor] Unable to decode > > raw message 2808ffa4-3964-11e6-ae65-005056937893 (journal offset > 84512788) > > encoded as gelf received from /10.100.1.10:50911. > > > > > > Last, ran it again a server built from scratch with > graylog-server-2.0.3-1 > > and still have the same issue. > > > > 2016-06-23T13:09:01.840-04:00 ERROR [GelfCodec] Could not parse JSON, > first > > 400 characters: �$��D�Q�ݑ�/[�m��. > > umv�6Ӭ�����5>btt��h�Rx��S]o�0�+V�Z�AvBȞ��� > > �����y��)歷�1ń��x�����W-�\�{0V�&��a�]��Nm� > > com.fasterxml.jackson.core.JsonParseException: Unexpected character ('�' > > (code 65533 / 0xfffd)): expected a valid value (number, String, array, > > object, 'true', 'false' or 'null') > > at [Source: �$��D�Q�ݑ�/[�m��. umv�6Ӭ�����5>btt��h�Rx��S]o�0�+V�Z�AvBȞ��� > > �����y��)歷�1ń��x�����W-; line: 1, column: 2] > > at > > > com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1581) > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:533) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.base.ParserMinimalBase._reportUnexpectedChar(ParserMinimalBase.java:462) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1624) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:689) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3771) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3716) > > > > ~[graylog.jar:?] > > at > > > com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2272) > > > ~[graylog.jar:?] > > at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:115) > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:136) > > > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:82) > > > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58) > > > > [graylog.jar:?] > > at > > > org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35) > > > > [graylog.jar:?] > > at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:139) > > [graylog.jar:?] > > at > > > com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) > > > > [graylog.jar:?] > > at java.lang.Thread.run(Thread.java:745) [?:1.8.0_73] > > 2016-06-23T13:09:01.857-04:00 ERROR [DecodingProcessor] Unable to decode > > raw message 2e97f704-3965-11e6-b0e7-005056930c85 (journal offset 78064) > > encoded as gelf received from /10.100.1.10:61360. > > > > > > > > A problem with NXLog or Graylog 2.0.3-1? This issue did not exist before > > the upgrade and the only change is the upgrade. Not sure what is > happening > > here? > > > > > > > > Thanks - Shon > > > > > > On Thursday, June 23, 2016 at 11:08:39 AM UTC-4, Shon Nixon wrote: > > > > > All my NXlog files look like: > > > > > > > > > define ROOT C:\Program Files (x86)\nxlog > > > > > > > > > > > > Module xm_gelf > > > > > > > > > > > > define ROOT C:\Program Files (x86)\nxlog > > > > > > Moduledir %ROOT%\modules > > > > > > CacheDir %ROOT%\data > > > > > > Pidfile %ROOT%\data\nxlog.pid > > > > > > SpoolDir %ROOT%\data > > > > > > LogFile %ROOT%\data\nxlog.log > > > > > > > > > > > > Module xm_gelf > > > > > > > > > > > > > > > > > > Module im_msvistalog > > > > > > > > > > > > > > > > > > Module om_tcp > > > > > > Host > > > > > > Port 12201 > > > > > > OutputType GELF > > > > > > > > > > > > > > > > > > Path in => out > > > > > > > > > > > > > > > > > > All I did was perform the upgrade of Graylog, nothing more. I always > check > > > log files to make sure the new upgrade took and that's when this > started > > > happening--immediately. > > > > > > > > > > > > > > > Thanks - Shon > > > > > > > > > > > > On Thursday, June 23, 2016 at 11:05:56 AM UTC-4, Shon Nixon wrote: > > > > > >> It would appear that Graylog is adding additional lines in the NXlog > > >> file. My snippet is: > > >> > > >> define ROOT C:\Program Files (x86)\nxlog > > >> Moduledir %ROOT%\modules > > >> CacheDir %ROOT%\data > > >> Pidfile %ROOT%\data\nxlog.pid > > >> SpoolDir %ROOT%\data > > >> LogFile %ROOT%\data\nxlog.log > > >> > > >> > > >> Module xm_gelf > > >> > > >> > > >> > > >> Module im_msvistalog > > >> > > >> > > >> > > >> Module om_tcp > > >> Host 10.100.150.89 > > >> Port 12201 > > >> OutputType GELF > > >> > > >> > > >> > > >> Path in => out > > >> > > >> > > >> > > >> Graylog is adding: > > >> > > >> define ROOT C:\Program Files (x86)\nxlog > > >> > > >> > > >> > > >> Module xm_gelf > > >> > > >> > > >> > > >> > > >> to the top of every Nxlog file. > > >> > > >> > > >> Many Thanks - Shon > > >> > > >> > > >> > > >> On Thursday, June 23, 2016 at 6:05:55 AM UTC-4, Marius Sturm wrote: > > >> > > >>> Hi, > > >>> looks like your receiving some binary data on a plain text Gelf > input. > > >>> Did you switch to TLS encryption or soemthing like that after the > update? > > >>> Could you please post the generated configuration of NXlog? > > >>> > > >>> Cheers, > > >>> Marius > > >>> > > >>> On Wednesday, 22 June 2016 16:27:41 UTC+2, Shon Nixon wrote: > > >>>> > > >>>> Built a Graylog 2.0 cluster two weeks ago with three servers > running > > >>>> 2.0.2 behind a HAProxy server. Server accepts logs from all Windows > boxes > > >>>> using Graylog Sidecar and Nxlog. Was working perfectly until I > upgraded the > > >>>> server to 2.0.3 (yum upgrade). Restarted the services and now I get > a > > >>>> constant flow of the log info below. Also can no longer access > *System/Inputs > > >>>> -> Configurations* page. Just shows blank. I do have another two > box > > >>>> cluster I built yesterday that started with 2.0.3 and has no issues > at all > > >>>> getting data from the HAProxy box. I would rather not rebuild this > cluster > > >>>> if possible... > > >>>> > > >>>> > > >>>> Reoccurring logging on all three boxes: > > >>>> > > >>>> > > >>>> 2016-06-22T10:15:13.732-04:00 ERROR [GelfCodec] Could not parse > JSON, > > >>>> first 400 characters: ���vb� ����wxz�Tv��<�Q���u]?�I� �z�� > > >>>> com.fasterxml.jackson.core.JsonParseException: Unexpected character > > >>>> ('�' (code 65533 / 0xfffd)): expected a valid value (number, > String, array, > > >>>> object, 'true', 'false' or 'null') > > >>>> at [Source: ���vb� ����wxz�Tv��<�Q���u]?�I� �z��; line: 1, column: > > >>>> 2] > > >>>> at > > >>>> > com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1581) > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:533) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.core.base.ParserMinimalBase._reportUnexpectedChar(ParserMinimalBase.java:462) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1624) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:689) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3771) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3716) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2272) > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:115) > > >>>> [graylog.jar:?] > > >>>> at > > >>>> > org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:136) > > > > >>>> [graylog.jar:?] > > >>>> at > > >>>> > org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:82) > > > > >>>> [graylog.jar:?] > > >>>> at > > >>>> > org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58) > > > > >>>> [graylog.jar:?] > > >>>> at > > >>>> > org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35) > > > > >>>> [graylog.jar:?] > > >>>> at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:139) > > >>>> [graylog.jar:?] > > >>>> at > > >>>> > com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) > > > > >>>> [graylog.jar:?] > > >>>> at java.lang.Thread.run(Thread.java:745) [?:1.8.0_73] > > >>>> 2016-06-22T10:15:13.732-04:00 ERROR [DecodingProcessor] Unable to > > >>>> decode raw message bc89d68a-3883-11e6-a89e-005056934db8 (journal > offset > > >>>> 56420554) encoded as gelf received from /10.100.150.89:41076. > > >>>> 2016-06-22T10:15:13.732-04:00 ERROR [DecodingProcessor] Error > > >>>> processing message > RawMessage{id=bc89d68a-3883-11e6-a89e-005056934db8, > > >>>> journalOffset=56420554, codec=gelf, payloadSize=41, > > >>>> timestamp=2016-06-22T14:15:13.640Z, remoteAddress=/ > 10.100.150.89:41076} > > >>>> com.fasterxml.jackson.core.JsonParseException: Unexpected character > > >>>> ('�' (code 65533 / 0xfffd)): expected a valid value (number, > String, array, > > >>>> object, 'true', 'false' or 'null') > > >>>> at [Source: ���vb� ����wxz�Tv��<�Q���u]?�I� �z��; line: 1, column: > > >>>> 2] > > >>>> at > > >>>> > com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1581) > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:533) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.core.base.ParserMinimalBase._reportUnexpectedChar(ParserMinimalBase.java:462) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1624) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:689) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3771) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3716) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2272) > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:115) > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:136) > > > > >>>> ~[graylog.jar:?] > > >>>> at > > >>>> > org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:82) > > > > >>>> [graylog.jar:?] > > >>>> at > > >>>> > org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58) > > > > >>>> [graylog.jar:?] > > >>>> at > > >>>> > org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35) > > > > >>>> [graylog.jar:?] > > >>>> at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:139) > > >>>> [graylog.jar:?] > > >>>> at > > >>>> > com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) > > > > >>>> [graylog.jar:?] > > >>>> at java.lang.Thread.run(Thread.java:745) [?:1.8.0_73] > > >>>> > > >>> > > > > -- > > You received this message because you are subscribed to the Google > Groups "Graylog Users" > > group. > > To unsubscribe from this group and stop receiving emails from it, send > an email to [email protected] <javascript:>. > > To view this discussion on the web visit > https://groups.google.com/d/msgid/graylog2/25b2ce8f-58f5-4d10-8cae-32caa384ad40%40googlegroups.com. > > > > For more options, visit https://groups.google.com/d/optout. > > >
-- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/a03f8dcc-4411-4dc4-9bbf-f575a7508d90%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
