This is what I figured out to have it back on track: graylog-ctl stop rm -r /var/opt/graylog/data/journal/* graylog-ctl start
Then cycle deflector (very important) and you should have it back on track. Unfortunately, you will lose all the journal messages. I tried deleting only parts of the journal (those corrupted) but that didn't work to reset the counter properly. Only a complete deletion worked for me. I hope it helps :) On Friday, 26 August 2016 10:03:12 UTC-4, Obie wrote: > > Some commands or a link to a doc would be helpful here. > > On Thursday, August 4, 2016 at 12:53:46 PM UTC-4, [email protected] wrote: >> >> Ok so what are those commands?? Can you provide a link or something? >> Googling what you mention isn't very explicit and results aren't helpful. >> Thx >> >> On Tuesday, 5 April 2016 04:02:08 UTC-4, Jochen Schalanda wrote: >>> >>> Hi, >>> >>> it looks like your journal is corrupted. You can either try to recover >>> and repair it (see the journal-related commands in Graylog) or simply >>> remove the journal files from disk. >>> >>> Cheers, >>> Jochen >>> >>> On Monday, 4 April 2016 22:56:47 UTC+2, kluch wrote: >>>> >>>> After "out of disk space" I removed journals, old indices, cycled >>>> deflector and then even deleted all indices from ES but it not helped at >>>> all. All graylog nodes restarted and still nothing. >>>> I dont know from where graylog reads/displays negative (with minus) >>>> value of unprocessed messages. On web it looks like this: >>>> Processing *1* incoming and *0* outgoing msg/s. *-1,195,856,763 >>>> unprocessed messages* are currently in the journal, in 1 segments. *1 >>>> messages* have been appended to, and *0 messages* have been read from >>>> the journal in the last second. >>>> Moreover graylog does not write to elasticsearch so only unprocessed >>>> messages counter is changing. Time is in sync with ntp. Version 1.3.4 >>>> from OVA. >>>> Any help? >>>> >>> -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/2718c30f-08d5-42e6-8137-f82ab7b01460%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
