Re: [graylog2] Problem upgrading to Graylog 1.2 on Debian 8

[Bernd Ahlers]

Hi!

the repository packages for Debian 7 and 8 are currently not
upgradeable. Please remove the graylog-1.1-repository-debian7 first and
then install the graylog-1.2-repository-debian8 package.

Regards,
Bernd

Fisz [Tue, Sep 15, 2015 at 10:57:38PM -0700] wrote:
>Hello,
>I have problem with upgrading graylog to v1.2 on Debian. I've downloaded 
>package *graylog-1.2-repository-debian8_latest.deb*, but when I try to 
>install it - I've got only error like this below:
>dpkg: error processing archive graylog-1.2-repository-debian8_latest.deb 
>(--install):
> trying to overwrite '/etc/apt/trusted.gpg.d/graylog-keyring.gpg', which is 
>also in package graylog-1.1-repository-debian7 1.2.0-3
>
>I'm using Debian 8.2 - I know that I was using graylog-repository for 
>debian 7, but there was no available deb for debian 8.
>
>-- 
>You received this message because you are subscribed to the Google Groups 
>"Graylog Users" group.
>To unsubscribe from this group and stop receiving emails from it, send an 
>email to graylog2+unsubscr...@googlegroups.com.
>To view this discussion on the web visit 
>https://groups.google.com/d/msgid/graylog2/57dd116f-1225-4069-92b0-8fd8b183f2de%40googlegroups.com.
>For more options, visit https://groups.google.com/d/optout.


-- 
Developer

Tel.: +49 (0)40 609 452 077
Fax.: +49 (0)40 609 452 078

TORCH GmbH - A Graylog company
Steckelhörn 11
20457 Hamburg
Germany

Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175
Geschäftsführer: Lennart Koopmann (CEO)

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/20150916073337.GA7894%40tumbler.torch.local.
For more options, visit https://groups.google.com/d/optout.

Re: [graylog2] Re: Problem with streeam alerts after updating to graylog1.2

[Arie]

Hi Edmundo,

It was a rpm upgrade from the latest stable version: 1.1.6-1.noarch.rpm
No modifications to the config file.

Arie.

Op woensdag 16 september 2015 11:22:52 UTC+2 schreef Edmundo Alvarez:
>
> Hi Arie, 
>
> From which version did you upgrade to 1.2? It would also be helpful to 
> know if that was a clean installation or an upgrade from an even earlier 
> version. 
>
> Regards, 
>
> Edmundo 
>
> > On 16 Sep 2015, at 11:10, Arie  
> wrote: 
> > 
> > I'dd had an error on producing the clone, but it appeard to be there. 
> After putting the receivers in it, 
> > il looks like it is worrking. So whot is wrong with the original alerts. 
> ? 
> > 
> > 
> > Op woensdag 16 september 2015 10:55:54 UTC+2 schreef Arie: 
> > Cloning the stream is not possible either 
> > 
> > Op woensdag 16 september 2015 10:53:47 UTC+2 schreef Arie: 
> > Hi, 
> > 
> > we are encountering problems with stream alerts after the update. 
> > When editing/testing the alert condition we get this message in the GUI. 
> > 
> > Could not retrieve AlarmCallbacks 
> > Fetching AlarmCallbacks failed with status: Internal Server Error 
> > 
> > 
> > server logfile (partial): 
> > 
> >  ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource 
> > com.mongodb.MongoException$Network: Read operation to server 
> localhost:27017 failed on database graylog2 
> > at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298) 
> > at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66) 
> > at com.mongodb.DBCursor._check(DBCursor.java:498) 
> > at com.mongodb.DBCursor._hasNext(DBCursor.java:621) 
> > at com.mongodb.DBCursor._fill(DBCursor.java:726) 
> > at com.mongodb.DBCursor.toArray(DBCursor.java:763) 
> > at org.mongojack.DBCursor.toArray(DBCursor.java:426) 
> > at org.mongojack.DBCursor.toArray(DBCursor.java:411) 
> > 
> > 
> > Caused by: com.fasterxml.jackson.databind.JsonMappingException: Can not 
> construct instance of java.lang.String, problem: Expected an ObjectId to 
> deserialise to string, but found class java.lang.String 
> >  at [Source: 
> de.undercouch.bson4jackson.io.LittleEndianInputStream@2909ef06; pos: 21] 
> (through reference chain: 
> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationAVImpl["id"]) 
> > at 
> com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:148)
>  
>
> > at 
> com.fasterxml.jackson.databind.DeserializationContext.instantiationException(DeserializationContext.java:889)
>  
>
> > at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:55)
>  
>
> > at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:37)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.SettableBeanProperty.deserialize(SettableBeanProperty.java:520)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeWithErrorWrapping(BeanDeserializer.java:461)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeUsingPropertyBased(BeanDeserializer.java:377)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.deserializeFromObjectUsingNonDefault(BeanDeserializerBase.java:1100)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:294)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:131)
>  
>
> > at 
> com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:3674)
>  
>
> > at 
> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2062) 
>
> > at 
> org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:77)
>  
>
> > at com.mongodb.Response.(Response.java:85) 
> > at com.mongodb.DBPort$1.execute(DBPort.java:164) 
> > at com.mongodb.DBPort$1.execute(DBPort.java:158) 
> > at com.mongodb.DBPort.doOperation(DBPort.java:187) 
> > at com.mongodb.DBPort.call(DBPort.java:158) 
> > 
> > 2015-09-16T10:43:35.254+02:00 ERROR [AnyExceptionClassMapper] Unhandled 
> exception in REST resource 
> > com.mongodb.MongoException$Network: Read operation to server 
> localhost:27017 failed on database graylog2 
> > at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298) 
> > at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66) 
> > at com.mongodb.DBCursor._check(DBCursor.java:498) 
> > at 

Re: [graylog2] Re: Problem with streeam alerts after updating to graylog1.2

[Edmundo Alvarez]

Hi Arie,

>From which version did you upgrade to 1.2? It would also be helpful to know if 
>that was a clean installation or an upgrade from an even earlier version.

Regards,

Edmundo

> On 16 Sep 2015, at 11:10, Arie  wrote:
> 
> I'dd had an error on producing the clone, but it appeard to be there. After 
> putting the receivers in it,
> il looks like it is worrking. So whot is wrong with the original alerts. ?
> 
> 
> Op woensdag 16 september 2015 10:55:54 UTC+2 schreef Arie:
> Cloning the stream is not possible either
> 
> Op woensdag 16 september 2015 10:53:47 UTC+2 schreef Arie:
> Hi,
> 
> we are encountering problems with stream alerts after the update.
> When editing/testing the alert condition we get this message in the GUI.
> 
> Could not retrieve AlarmCallbacks
> Fetching AlarmCallbacks failed with status: Internal Server Error
> 
> 
> server logfile (partial):
> 
>  ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
> com.mongodb.MongoException$Network: Read operation to server localhost:27017 
> failed on database graylog2
> at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298)
> at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269)
> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84)
> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66)
> at com.mongodb.DBCursor._check(DBCursor.java:498)
> at com.mongodb.DBCursor._hasNext(DBCursor.java:621)
> at com.mongodb.DBCursor._fill(DBCursor.java:726)
> at com.mongodb.DBCursor.toArray(DBCursor.java:763)
> at org.mongojack.DBCursor.toArray(DBCursor.java:426)
> at org.mongojack.DBCursor.toArray(DBCursor.java:411)
> 
> 
> Caused by: com.fasterxml.jackson.databind.JsonMappingException: Can not 
> construct instance of java.lang.String, problem: Expected an ObjectId to 
> deserialise to string, but found class java.lang.String
>  at [Source: de.undercouch.bson4jackson.io.LittleEndianInputStream@2909ef06; 
> pos: 21] (through reference chain: 
> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationAVImpl["id"])
> at 
> com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:148)
> at 
> com.fasterxml.jackson.databind.DeserializationContext.instantiationException(DeserializationContext.java:889)
> at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:55)
> at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:37)
> at 
> com.fasterxml.jackson.databind.deser.SettableBeanProperty.deserialize(SettableBeanProperty.java:520)
> at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeWithErrorWrapping(BeanDeserializer.java:461)
> at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeUsingPropertyBased(BeanDeserializer.java:377)
> at 
> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.deserializeFromObjectUsingNonDefault(BeanDeserializerBase.java:1100)
> at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:294)
> at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:131)
> at 
> com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:3674)
> at 
> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2062)
> at 
> org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:77)
> at com.mongodb.Response.(Response.java:85)
> at com.mongodb.DBPort$1.execute(DBPort.java:164)
> at com.mongodb.DBPort$1.execute(DBPort.java:158)
> at com.mongodb.DBPort.doOperation(DBPort.java:187)
> at com.mongodb.DBPort.call(DBPort.java:158)
> 
> 2015-09-16T10:43:35.254+02:00 ERROR [AnyExceptionClassMapper] Unhandled 
> exception in REST resource
> com.mongodb.MongoException$Network: Read operation to server localhost:27017 
> failed on database graylog2
> at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298)
> at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269)
> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84)
> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66)
> at com.mongodb.DBCursor._check(DBCursor.java:498)
> at com.mongodb.DBCursor._hasNext(DBCursor.java:621)
> at com.mongodb.DBCursor._fill(DBCursor.java:726)
> at com.mongodb.DBCursor.toArray(DBCursor.java:763)
> at org.mongojack.DBCursor.toArray(DBCursor.java:426)
> at org.mongojack.DBCursor.toArray(DBCursor.java:411)
> at 
> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationServiceMJImpl.getForStreamId(AlarmCallbackConfigurationServiceMJImpl.java:48)
> at 
> 

[graylog2] Re: create inputs using config file

[ivan morozov]

So far i know input configuration are stored in mongo data and mapped to 
node id, so if you keep you mongo db and use same node id it should work

Am Mittwoch, 16. September 2015 11:01:35 UTC+2 schrieb Ming Fang:
>
> Is there a way to create inputs using a config file?
>
> I want a set of inputs to be automatically create if necessary based on 
> settings in a config file.
> Currently I creating the inputs using the REST Api.
> See the end of my Dockerfile here 
> https://github.com/mingfang/docker-graylog/blob/master/Dockerfile
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/02690d26-2f14-462b-8b95-6d711c61d0cf%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] create inputs using config file

[Ming Fang]

Is there a way to create inputs using a config file?

I want a set of inputs to be automatically create if necessary based on 
settings in a config file.
Currently I creating the inputs using the REST Api.
See the end of my Dockerfile 
here https://github.com/mingfang/docker-graylog/blob/master/Dockerfile

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/15d7ea4b-e9da-4d91-a5b7-63dc9cc79c7a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Updated Graylog Appliance 1.1.6

[rogersmanau]

Hi All,

Apologies if this has been asked previously. Is this still the correct 
guidance to upgrade the Graylog appliance from 1.1.6 to the new 1.2GA? 
http://docs.graylog.org/en/1.2/pages/installation/graylog_ctl.html#upgrade-graylog
 


Many Thanks,
James.

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/5a11319b-6ae0-452f-b3cf-a1c8ff67ed34%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [graylog2] graylog extractor regular expression

[Sriranga Kulkarni]

Thanks Kay !
That worked 


On Sunday, September 13, 2015 at 6:29:06 PM UTC+5:30, Kay Röpke wrote:
>
> Hi!
>
> You can use standard regular expression syntax here (the Java flavor). 
> Simply anchor the regex at the end of the string.
>
> /(\w+)$
>
> That should do the trick, you can verify in the extractor builder.
>
> cheers,
> -k
>
> On 12 Sep 2015, at 20:02, Sriranga Kulkarni  > wrote:
>
> I want to extract the last field of the message . For example if i have 
> message as below 
>
> */api/provider/brand  - In this case i want the field to be 'brand' *
>
> but the message format may differ in the above example it has 3 parameters 
> i want the 3rd but there will be messages where there will be 4 parameters 
> so i am looking for expression which captures last field irrespective of 
> how many parameters it has it should start from last and capture the field 
> starting from last
>
> -- 
> You received this message because you are subscribed to the Google Groups 
> "Graylog Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to graylog2+u...@googlegroups.com .
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/graylog2/2ce4a204-1c4b-4abf-a27f-2227aadcc6c5%40googlegroups.com
>  
> 
> .
> For more options, visit https://groups.google.com/d/optout.
>
>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/b17ade90-d4c1-49ce-af94-0d7d4665ad79%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Problem with streeam alerts after updating to graylog1.2

[Arie]

Cloning the stream is not possible either

Op woensdag 16 september 2015 10:53:47 UTC+2 schreef Arie:
>
> Hi,
>
> we are encountering problems with stream alerts after the update.
> When editing/testing the alert condition we get this message in the GUI.
>
> *Could not retrieve AlarmCallbacks*
> *Fetching AlarmCallbacks failed with status: Internal Server Error*
>
>
> server logfile (partial):
>
>  ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
> com.mongodb.MongoException$Network: Read operation to server 
> localhost:27017 failed on database graylog2
> at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298)
> at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269)
> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84)
> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66)
> at com.mongodb.DBCursor._check(DBCursor.java:498)
> at com.mongodb.DBCursor._hasNext(DBCursor.java:621)
> at com.mongodb.DBCursor._fill(DBCursor.java:726)
> at com.mongodb.DBCursor.toArray(DBCursor.java:763)
> at org.mongojack.DBCursor.toArray(DBCursor.java:426)
> at org.mongojack.DBCursor.toArray(DBCursor.java:411)
>
>
> Caused by: com.fasterxml.jackson.databind.JsonMappingException: Can not 
> construct instance of java.lang.String, problem: Expected an ObjectId to 
> deserialise to string, but found class java.lang.String
>  at [Source: 
> de.undercouch.bson4jackson.io.LittleEndianInputStream@2909ef06; pos: 21] 
> (through reference chain: 
> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationAVImpl["id"])
> at 
> com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:148)
> at 
> com.fasterxml.jackson.databind.DeserializationContext.instantiationException(DeserializationContext.java:889)
> at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:55)
> at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:37)
> at 
> com.fasterxml.jackson.databind.deser.SettableBeanProperty.deserialize(SettableBeanProperty.java:520)
> at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeWithErrorWrapping(BeanDeserializer.java:461)
> at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeUsingPropertyBased(BeanDeserializer.java:377)
> at 
> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.deserializeFromObjectUsingNonDefault(BeanDeserializerBase.java:1100)
> at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:294)
> at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:131)
> at 
> com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:3674)
> at 
> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2062)
> at 
> org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:77)
> at com.mongodb.Response.(Response.java:85)
> at com.mongodb.DBPort$1.execute(DBPort.java:164)
> at com.mongodb.DBPort$1.execute(DBPort.java:158)
> at com.mongodb.DBPort.doOperation(DBPort.java:187)
> at com.mongodb.DBPort.call(DBPort.java:158)
>
> 2015-09-16T10:43:35.254+02:00 ERROR [AnyExceptionClassMapper] Unhandled 
> exception in REST resource
> com.mongodb.MongoException$Network: Read operation to server 
> localhost:27017 failed on database graylog2
> at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298)
> at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269)
> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84)
> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66)
> at com.mongodb.DBCursor._check(DBCursor.java:498)
> at com.mongodb.DBCursor._hasNext(DBCursor.java:621)
> at com.mongodb.DBCursor._fill(DBCursor.java:726)
> at com.mongodb.DBCursor.toArray(DBCursor.java:763)
> at org.mongojack.DBCursor.toArray(DBCursor.java:426)
> at org.mongojack.DBCursor.toArray(DBCursor.java:411)
> at 
> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationServiceMJImpl.getForStreamId(AlarmCallbackConfigurationServiceMJImpl.java:48)
> at 
> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationServiceMJImpl.getForStream(AlarmCallbackConfigurationServiceMJImpl.java:53)
> at 
> org.graylog2.rest.resources.streams.alerts.StreamAlertReceiverResource.sendDummyAlert(StreamAlertReceiverResource.java:164)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at 
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> at 
> 

[graylog2] Re: Problem with streeam alerts after updating to graylog1.2

[Arie]

I'dd had an error on producing the clone, but it appeard to be there. After 
putting the receivers in it,
il looks like it is worrking. So whot is wrong with the original alerts. ?


Op woensdag 16 september 2015 10:55:54 UTC+2 schreef Arie:
>
> Cloning the stream is not possible either
>
> Op woensdag 16 september 2015 10:53:47 UTC+2 schreef Arie:
>>
>> Hi,
>>
>> we are encountering problems with stream alerts after the update.
>> When editing/testing the alert condition we get this message in the GUI.
>>
>> *Could not retrieve AlarmCallbacks*
>> *Fetching AlarmCallbacks failed with status: Internal Server Error*
>>
>>
>> server logfile (partial):
>>
>>  ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
>> com.mongodb.MongoException$Network: Read operation to server 
>> localhost:27017 failed on database graylog2
>> at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298)
>> at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269)
>> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84)
>> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66)
>> at com.mongodb.DBCursor._check(DBCursor.java:498)
>> at com.mongodb.DBCursor._hasNext(DBCursor.java:621)
>> at com.mongodb.DBCursor._fill(DBCursor.java:726)
>> at com.mongodb.DBCursor.toArray(DBCursor.java:763)
>> at org.mongojack.DBCursor.toArray(DBCursor.java:426)
>> at org.mongojack.DBCursor.toArray(DBCursor.java:411)
>>
>>
>> Caused by: com.fasterxml.jackson.databind.JsonMappingException: Can not 
>> construct instance of java.lang.String, problem: Expected an ObjectId to 
>> deserialise to string, but found class java.lang.String
>>  at [Source: 
>> de.undercouch.bson4jackson.io.LittleEndianInputStream@2909ef06; pos: 21] 
>> (through reference chain: 
>> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationAVImpl["id"])
>> at 
>> com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:148)
>> at 
>> com.fasterxml.jackson.databind.DeserializationContext.instantiationException(DeserializationContext.java:889)
>> at 
>> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:55)
>> at 
>> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:37)
>> at 
>> com.fasterxml.jackson.databind.deser.SettableBeanProperty.deserialize(SettableBeanProperty.java:520)
>> at 
>> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeWithErrorWrapping(BeanDeserializer.java:461)
>> at 
>> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeUsingPropertyBased(BeanDeserializer.java:377)
>> at 
>> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.deserializeFromObjectUsingNonDefault(BeanDeserializerBase.java:1100)
>> at 
>> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:294)
>> at 
>> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:131)
>> at 
>> com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:3674)
>> at 
>> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2062)
>> at 
>> org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:77)
>> at com.mongodb.Response.(Response.java:85)
>> at com.mongodb.DBPort$1.execute(DBPort.java:164)
>> at com.mongodb.DBPort$1.execute(DBPort.java:158)
>> at com.mongodb.DBPort.doOperation(DBPort.java:187)
>> at com.mongodb.DBPort.call(DBPort.java:158)
>>
>> 2015-09-16T10:43:35.254+02:00 ERROR [AnyExceptionClassMapper] Unhandled 
>> exception in REST resource
>> com.mongodb.MongoException$Network: Read operation to server 
>> localhost:27017 failed on database graylog2
>> at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298)
>> at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269)
>> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84)
>> at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66)
>> at com.mongodb.DBCursor._check(DBCursor.java:498)
>> at com.mongodb.DBCursor._hasNext(DBCursor.java:621)
>> at com.mongodb.DBCursor._fill(DBCursor.java:726)
>> at com.mongodb.DBCursor.toArray(DBCursor.java:763)
>> at org.mongojack.DBCursor.toArray(DBCursor.java:426)
>> at org.mongojack.DBCursor.toArray(DBCursor.java:411)
>> at 
>> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationServiceMJImpl.getForStreamId(AlarmCallbackConfigurationServiceMJImpl.java:48)
>> at 
>> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationServiceMJImpl.getForStream(AlarmCallbackConfigurationServiceMJImpl.java:53)
>> at 
>> 

[graylog2] Problem with streeam alerts after updating to graylog1.2

[Arie]

Hi,

we are encountering problems with stream alerts after the update.
When editing/testing the alert condition we get this message in the GUI.

*Could not retrieve AlarmCallbacks*
*Fetching AlarmCallbacks failed with status: Internal Server Error*


server logfile (partial):

 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
com.mongodb.MongoException$Network: Read operation to server 
localhost:27017 failed on database graylog2
at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298)
at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269)
at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84)
at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66)
at com.mongodb.DBCursor._check(DBCursor.java:498)
at com.mongodb.DBCursor._hasNext(DBCursor.java:621)
at com.mongodb.DBCursor._fill(DBCursor.java:726)
at com.mongodb.DBCursor.toArray(DBCursor.java:763)
at org.mongojack.DBCursor.toArray(DBCursor.java:426)
at org.mongojack.DBCursor.toArray(DBCursor.java:411)


Caused by: com.fasterxml.jackson.databind.JsonMappingException: Can not 
construct instance of java.lang.String, problem: Expected an ObjectId to 
deserialise to string, but found class java.lang.String
 at [Source: 
de.undercouch.bson4jackson.io.LittleEndianInputStream@2909ef06; pos: 21] 
(through reference chain: 
org.graylog2.alarmcallbacks.AlarmCallbackConfigurationAVImpl["id"])
at 
com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:148)
at 
com.fasterxml.jackson.databind.DeserializationContext.instantiationException(DeserializationContext.java:889)
at 
org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:55)
at 
org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:37)
at 
com.fasterxml.jackson.databind.deser.SettableBeanProperty.deserialize(SettableBeanProperty.java:520)
at 
com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeWithErrorWrapping(BeanDeserializer.java:461)
at 
com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeUsingPropertyBased(BeanDeserializer.java:377)
at 
com.fasterxml.jackson.databind.deser.BeanDeserializerBase.deserializeFromObjectUsingNonDefault(BeanDeserializerBase.java:1100)
at 
com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:294)
at 
com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:131)
at 
com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:3674)
at 
com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2062)
at 
org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:77)
at com.mongodb.Response.(Response.java:85)
at com.mongodb.DBPort$1.execute(DBPort.java:164)
at com.mongodb.DBPort$1.execute(DBPort.java:158)
at com.mongodb.DBPort.doOperation(DBPort.java:187)
at com.mongodb.DBPort.call(DBPort.java:158)

2015-09-16T10:43:35.254+02:00 ERROR [AnyExceptionClassMapper] Unhandled 
exception in REST resource
com.mongodb.MongoException$Network: Read operation to server 
localhost:27017 failed on database graylog2
at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298)
at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269)
at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84)
at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66)
at com.mongodb.DBCursor._check(DBCursor.java:498)
at com.mongodb.DBCursor._hasNext(DBCursor.java:621)
at com.mongodb.DBCursor._fill(DBCursor.java:726)
at com.mongodb.DBCursor.toArray(DBCursor.java:763)
at org.mongojack.DBCursor.toArray(DBCursor.java:426)
at org.mongojack.DBCursor.toArray(DBCursor.java:411)
at 
org.graylog2.alarmcallbacks.AlarmCallbackConfigurationServiceMJImpl.getForStreamId(AlarmCallbackConfigurationServiceMJImpl.java:48)
at 
org.graylog2.alarmcallbacks.AlarmCallbackConfigurationServiceMJImpl.getForStream(AlarmCallbackConfigurationServiceMJImpl.java:53)
at 
org.graylog2.rest.resources.streams.alerts.StreamAlertReceiverResource.sendDummyAlert(StreamAlertReceiverResource.java:164)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:497)

Caused by: com.fasterxml.jackson.databind.JsonMappingException: Can not 
construct instance of java.lang.String, problem: Expected an ObjectId to 
deserialise to string, but found class 

Re: [graylog2] Re: Problem with streeam alerts after updating to graylog1.2

[Arie]

And second:

In the alert the "callbacks" part in the GUI keeps "loading" going on 
endlesly.
I remember editing the calback email condition so we are closer intho the 
problem I guess

Arie 

Op woensdag 16 september 2015 11:22:52 UTC+2 schreef Edmundo Alvarez:
>
> Hi Arie, 
>
> From which version did you upgrade to 1.2? It would also be helpful to 
> know if that was a clean installation or an upgrade from an even earlier 
> version. 
>
> Regards, 
>
> Edmundo 
>
> > On 16 Sep 2015, at 11:10, Arie  
> wrote: 
> > 
> > I'dd had an error on producing the clone, but it appeard to be there. 
> After putting the receivers in it, 
> > il looks like it is worrking. So whot is wrong with the original alerts. 
> ? 
> > 
> > 
> > Op woensdag 16 september 2015 10:55:54 UTC+2 schreef Arie: 
> > Cloning the stream is not possible either 
> > 
> > Op woensdag 16 september 2015 10:53:47 UTC+2 schreef Arie: 
> > Hi, 
> > 
> > we are encountering problems with stream alerts after the update. 
> > When editing/testing the alert condition we get this message in the GUI. 
> > 
> > Could not retrieve AlarmCallbacks 
> > Fetching AlarmCallbacks failed with status: Internal Server Error 
> > 
> > 
> > server logfile (partial): 
> > 
> >  ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource 
> > com.mongodb.MongoException$Network: Read operation to server 
> localhost:27017 failed on database graylog2 
> > at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298) 
> > at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66) 
> > at com.mongodb.DBCursor._check(DBCursor.java:498) 
> > at com.mongodb.DBCursor._hasNext(DBCursor.java:621) 
> > at com.mongodb.DBCursor._fill(DBCursor.java:726) 
> > at com.mongodb.DBCursor.toArray(DBCursor.java:763) 
> > at org.mongojack.DBCursor.toArray(DBCursor.java:426) 
> > at org.mongojack.DBCursor.toArray(DBCursor.java:411) 
> > 
> > 
> > Caused by: com.fasterxml.jackson.databind.JsonMappingException: Can not 
> construct instance of java.lang.String, problem: Expected an ObjectId to 
> deserialise to string, but found class java.lang.String 
> >  at [Source: 
> de.undercouch.bson4jackson.io.LittleEndianInputStream@2909ef06; pos: 21] 
> (through reference chain: 
> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationAVImpl["id"]) 
> > at 
> com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:148)
>  
>
> > at 
> com.fasterxml.jackson.databind.DeserializationContext.instantiationException(DeserializationContext.java:889)
>  
>
> > at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:55)
>  
>
> > at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:37)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.SettableBeanProperty.deserialize(SettableBeanProperty.java:520)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeWithErrorWrapping(BeanDeserializer.java:461)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeUsingPropertyBased(BeanDeserializer.java:377)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.deserializeFromObjectUsingNonDefault(BeanDeserializerBase.java:1100)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:294)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:131)
>  
>
> > at 
> com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:3674)
>  
>
> > at 
> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2062) 
>
> > at 
> org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:77)
>  
>
> > at com.mongodb.Response.(Response.java:85) 
> > at com.mongodb.DBPort$1.execute(DBPort.java:164) 
> > at com.mongodb.DBPort$1.execute(DBPort.java:158) 
> > at com.mongodb.DBPort.doOperation(DBPort.java:187) 
> > at com.mongodb.DBPort.call(DBPort.java:158) 
> > 
> > 2015-09-16T10:43:35.254+02:00 ERROR [AnyExceptionClassMapper] Unhandled 
> exception in REST resource 
> > com.mongodb.MongoException$Network: Read operation to server 
> localhost:27017 failed on database graylog2 
> > at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298) 
> > at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66) 
> > at 

Re: [graylog2] extending disk of OVA deployed Graylog server (a newbie How-To)

[Marius Sturm]

Thanks for the detailed walk through! I have added this to the
documentation:
http://docs.graylog.org/en/1.2/pages/installation/graylog_ctl.html

On 15 September 2015 at 21:29, Lasse Taul Bjerre  wrote:

> Hi,
>
> New to Graylog, and not really a Linux user/admin.
>
> My LAB deployment quickly ran out of disk space.
> I searched the web and the documentation for a how to extend the disk, but
> could not find a Step by Step guide.
> I ended up doing it the following way - I have posted it in-case it can be
> helpful to other newbies.
> Any comments much appreciated.
>
>
> *shut down the VM (just incase you mess something up :) )*
>
> *take a snapshot*
>
> *attach new disk in vmware*
>
> *start the VM*
>
>
>
> *stop graylog services:*
>
> sudo graylog-ctl stop
>
>
>
> *identify new disk disk (a good bet is that it will be sdb):*
>
> sudo lshw -class disk
>
>
>
> *Output:*
>
>   *-disk
>
>description: SCSI Disk
>
>physical id: 0.0.0
>
>bus info: scsi@2:0.0.0
>
>*logical name: /dev/sdb*
>
>size: 100GiB (107GB)
>
>configuration: sectorsize=512
>
>   *-disk
>
>description: ATA Disk
>
>product: VMware Virtual I
>
>physical id: 0.0.0
>
>bus info: scsi@0:0.0.0
>
>logical name: /dev/sda
>
>version: 0001
>
>serial: 0001
>
>size: 19GiB (20GB)
>
>capabilities: partitioned partitioned:dos
>
>configuration: ansiversion=5 sectorsize=512 signature=00040ebf
>
>
> *In this case the new disk is called /dev/sdb*
>
>
> *format new disk (replace sdb with the disk found with the lshw command):*
>
> sudo mkfs.ext4 /dev/sdb
>
>
>
> *create temp mount point for new disk:*
>
> sudo mkdir /mnt/newData
>
>
>
> *mount disk to temp mount point*
>
> sudo mount /dev/sdb /mnt/newData
>
>
>
> *go to single user mode (might not be necessary, will kill SSH so do it
> from console):*
>
> sudo init 1
>
>
>
> *copy data to new drive*
>
> sudo cd /var/opt/graylog/data
>
> sudo cp –ax * /mnt/newData
>
>
>
> *compare the 2 folders*
>
> sudo diff –qr –suppress-common-lines /var/opt/graylog/data /mnt/newData
>
>
>
> *Output should be something like:*
>
> *Only in /mnt/newData: lost+found*
>
>
>
> *delete old data folder (to free up disk space on the initial disk)*
>
> sudo rm –r -f /var/opt/graylog/data
>
>
>
> *make new mount point*
>
> mkdir /var/opt/graylog/data
>
>
>
> *unmount the temp location*
>
> umount /dev/sdb
>
>
>
> *mount the new disk to the real location*
>
> mount /dev/sdb /var/opt/graylog/data
>
>
>
> *edit fstab to make the mount persistent:*
>
> nano /etc/fstab
>
>
>
> *add the folowing line into fstab*
>
> /dev/sdb   /var/opt/graylog/data  ext4defaults   0 0
>
>
>
> *reboot server*
>
> sudo shutdown –r now
>
> --
> You received this message because you are subscribed to the Google Groups
> "Graylog Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to graylog2+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/graylog2/9c1e08f9-bb8d-47b8-a338-6395649cc30e%40googlegroups.com
> 
> .
> For more options, visit https://groups.google.com/d/optout.
>



-- 
Developer

Tel.: +49 (0)40 609 452 077
Fax.: +49 (0)40 609 452 078

TORCH GmbH - A Graylog Company
Steckelhörn 11
20457 Hamburg
Germany

https://www.graylog.com 

Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175
Geschäftsführer: Lennart Koopmann (CEO)

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/CAMqbBb%2Byd%2Bo8mi3N3s%3DGBWRhvkwbk1y%2BNRaFcp1N5h78ge7Yhw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: [graylog2] Re: Problem with streeam alerts after updating to graylog1.2

[Arie]

That is very well possible, 1.0 or 1.01 but not totally shore of it.

In one of the upgrades I had a problem with some data that was the result 
of a Yum update from repository
where old data was deleted an a wrong/missing node-id file.

We use the contend-pack function for backup of a lot of settings, an what I 
see now is that the callback
function is not present there, and may be missing in my present stream 
configs.

Arie

Op woensdag 16 september 2015 11:45:55 UTC+2 schreef Edmundo Alvarez:
>
> That previous 1.1 version, was it an upgrade from 1.0 by any chance? 
>
> Edmundo 
>
> > On 16 Sep 2015, at 11:39, Arie  
> wrote: 
> > 
> > And second: 
> > 
> > In the alert the "callbacks" part in the GUI keeps "loading" going on 
> endlesly. 
> > I remember editing the calback email condition so we are closer intho 
> the problem I guess 
> > 
> > Arie 
> > 
> > Op woensdag 16 september 2015 11:22:52 UTC+2 schreef Edmundo Alvarez: 
> > Hi Arie, 
> > 
> > From which version did you upgrade to 1.2? It would also be helpful to 
> know if that was a clean installation or an upgrade from an even earlier 
> version. 
> > 
> > Regards, 
> > 
> > Edmundo 
> > 
> > > On 16 Sep 2015, at 11:10, Arie  wrote: 
> > > 
> > > I'dd had an error on producing the clone, but it appeard to be there. 
> After putting the receivers in it, 
> > > il looks like it is worrking. So whot is wrong with the original 
> alerts. ? 
> > > 
> > > 
> > > Op woensdag 16 september 2015 10:55:54 UTC+2 schreef Arie: 
> > > Cloning the stream is not possible either 
> > > 
> > > Op woensdag 16 september 2015 10:53:47 UTC+2 schreef Arie: 
> > > Hi, 
> > > 
> > > we are encountering problems with stream alerts after the update. 
> > > When editing/testing the alert condition we get this message in the 
> GUI. 
> > > 
> > > Could not retrieve AlarmCallbacks 
> > > Fetching AlarmCallbacks failed with status: Internal Server Error 
> > > 
> > > 
> > > server logfile (partial): 
> > > 
> > >  ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource 
> > > com.mongodb.MongoException$Network: Read operation to server 
> localhost:27017 failed on database graylog2 
> > > at 
> com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298) 
> > > at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269) 
> > > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84) 
> > > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66) 
> > > at com.mongodb.DBCursor._check(DBCursor.java:498) 
> > > at com.mongodb.DBCursor._hasNext(DBCursor.java:621) 
> > > at com.mongodb.DBCursor._fill(DBCursor.java:726) 
> > > at com.mongodb.DBCursor.toArray(DBCursor.java:763) 
> > > at org.mongojack.DBCursor.toArray(DBCursor.java:426) 
> > > at org.mongojack.DBCursor.toArray(DBCursor.java:411) 
> > > 
> > > 
> > > Caused by: com.fasterxml.jackson.databind.JsonMappingException: Can 
> not construct instance of java.lang.String, problem: Expected an ObjectId 
> to deserialise to string, but found class java.lang.String 
> > >  at [Source: 
> de.undercouch.bson4jackson.io.LittleEndianInputStream@2909ef06; pos: 21] 
> (through reference chain: 
> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationAVImpl["id"]) 
> > > at 
> com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:148)
>  
>
> > > at 
> com.fasterxml.jackson.databind.DeserializationContext.instantiationException(DeserializationContext.java:889)
>  
>
> > > at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:55)
>  
>
> > > at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:37)
>  
>
> > > at 
> com.fasterxml.jackson.databind.deser.SettableBeanProperty.deserialize(SettableBeanProperty.java:520)
>  
>
> > > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeWithErrorWrapping(BeanDeserializer.java:461)
>  
>
> > > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeUsingPropertyBased(BeanDeserializer.java:377)
>  
>
> > > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.deserializeFromObjectUsingNonDefault(BeanDeserializerBase.java:1100)
>  
>
> > > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:294)
>  
>
> > > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:131)
>  
>
> > > at 
> com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:3674)
>  
>
> > > at 
> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2062) 
>
> > > at 
> org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:77)
>  
>
> > > at 

[graylog2] Re: create inputs using config file

[Jochen Schalanda]

Hi,

Graylog currently doesn't support a "bootstrap" configuration file with 
entity configurations (e. g. inputs, streams, outputs, etc.) but you can 
use the content pack feature to export a content pack containing your 
entity configurations and import/apply that to your Graylog setup via the 
REST API. This would at least minimize interaction with the REST API in 
your Dockerfile.


Cheers,
Jochen

On Wednesday, 16 September 2015 11:01:35 UTC+2, Ming Fang wrote:
>
> Is there a way to create inputs using a config file?
>
> I want a set of inputs to be automatically create if necessary based on 
> settings in a config file.
> Currently I creating the inputs using the REST Api.
> See the end of my Dockerfile here 
> https://github.com/mingfang/docker-graylog/blob/master/Dockerfile
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/38c373d0-15a7-4f92-9225-d3ad8a06252d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [graylog2] Re: Problem with streeam alerts after updating to graylog1.2

[Arie]

Hi Edmundo,

The (email) calback alerts that fail where made in a version prior to 1.1.

A callback alert recently made in the latest version (1.1.6) was fine after 
the update.

hth,,

Arie


Op woensdag 16 september 2015 11:22:52 UTC+2 schreef Edmundo Alvarez:
>
> Hi Arie, 
>
> From which version did you upgrade to 1.2? It would also be helpful to 
> know if that was a clean installation or an upgrade from an even earlier 
> version. 
>
> Regards, 
>
> Edmundo 
>
> > On 16 Sep 2015, at 11:10, Arie  
> wrote: 
> > 
> > I'dd had an error on producing the clone, but it appeard to be there. 
> After putting the receivers in it, 
> > il looks like it is worrking. So whot is wrong with the original alerts. 
> ? 
> > 
> > 
> > Op woensdag 16 september 2015 10:55:54 UTC+2 schreef Arie: 
> > Cloning the stream is not possible either 
> > 
> > Op woensdag 16 september 2015 10:53:47 UTC+2 schreef Arie: 
> > Hi, 
> > 
> > we are encountering problems with stream alerts after the update. 
> > When editing/testing the alert condition we get this message in the GUI. 
> > 
> > Could not retrieve AlarmCallbacks 
> > Fetching AlarmCallbacks failed with status: Internal Server Error 
> > 
> > 
> > server logfile (partial): 
> > 
> >  ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource 
> > com.mongodb.MongoException$Network: Read operation to server 
> localhost:27017 failed on database graylog2 
> > at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298) 
> > at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66) 
> > at com.mongodb.DBCursor._check(DBCursor.java:498) 
> > at com.mongodb.DBCursor._hasNext(DBCursor.java:621) 
> > at com.mongodb.DBCursor._fill(DBCursor.java:726) 
> > at com.mongodb.DBCursor.toArray(DBCursor.java:763) 
> > at org.mongojack.DBCursor.toArray(DBCursor.java:426) 
> > at org.mongojack.DBCursor.toArray(DBCursor.java:411) 
> > 
> > 
> > Caused by: com.fasterxml.jackson.databind.JsonMappingException: Can not 
> construct instance of java.lang.String, problem: Expected an ObjectId to 
> deserialise to string, but found class java.lang.String 
> >  at [Source: 
> de.undercouch.bson4jackson.io.LittleEndianInputStream@2909ef06; pos: 21] 
> (through reference chain: 
> org.graylog2.alarmcallbacks.AlarmCallbackConfigurationAVImpl["id"]) 
> > at 
> com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:148)
>  
>
> > at 
> com.fasterxml.jackson.databind.DeserializationContext.instantiationException(DeserializationContext.java:889)
>  
>
> > at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:55)
>  
>
> > at 
> org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:37)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.SettableBeanProperty.deserialize(SettableBeanProperty.java:520)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeWithErrorWrapping(BeanDeserializer.java:461)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeUsingPropertyBased(BeanDeserializer.java:377)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializerBase.deserializeFromObjectUsingNonDefault(BeanDeserializerBase.java:1100)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:294)
>  
>
> > at 
> com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:131)
>  
>
> > at 
> com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:3674)
>  
>
> > at 
> com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2062) 
>
> > at 
> org.mongojack.internal.stream.JacksonDBDecoder.decode(JacksonDBDecoder.java:77)
>  
>
> > at com.mongodb.Response.(Response.java:85) 
> > at com.mongodb.DBPort$1.execute(DBPort.java:164) 
> > at com.mongodb.DBPort$1.execute(DBPort.java:158) 
> > at com.mongodb.DBPort.doOperation(DBPort.java:187) 
> > at com.mongodb.DBPort.call(DBPort.java:158) 
> > 
> > 2015-09-16T10:43:35.254+02:00 ERROR [AnyExceptionClassMapper] Unhandled 
> exception in REST resource 
> > com.mongodb.MongoException$Network: Read operation to server 
> localhost:27017 failed on database graylog2 
> > at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298) 
> > at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84) 
> > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66) 
> > at 

Re: [graylog2] upgrading graylog-server from 1.16 to 1.2rc4 totally broke all LDAP access

[Kay Röpke]

For the sake of keeping a public record:

We discussed this privately and in the end Graylog 1.2 works as expected in 
this environment, but due to the specific constraints the page showing the 
Group mapping timed out waiting for an answer.
To work around this you can set this in the graylog-web-interface.conf:

timeout.DEFAULT=2 minutes

to a setting that makes sense. Usually the group traversal is fast enough so 
this is not necessary. We might change the timeout value for this request in 
the future.

1.2.0 also requests fewer attributes and uses DN lookups for groups in all of 
the common cases, so the group traversal is only done when editing the group 
mapping.

cheers,
-k
> On 10 Sep 2015, at 09:54, Kay Röpke  wrote:
> 
> Jason,
> 
> I’ve just found this in the LDAP library we use: 
> https://issues.apache.org/jira/browse/DIRAPI-196 
> 
> According to the code change this is simply a warning that gets logged as an 
> error, but it does not stop processing the entry.
> 
> I’ve uploaded an improved version to 
> https://s3-eu-west-1.amazonaws.com/pre-release-snapshots/graylog-1.2.0-rc.5-SNAPSHOT-20150909154719.tar.gz
>  
> 
> It is compatible with the RC.4 web interface, but won’t work with any version 
> before that due to API changes in the LDAP config.
> 
> This changes the following:
>  - only request object attributes that are really necessary for both users 
> and groups (the login test will still request all of them for the user)
> this should get rid of the blobs you are seeing and improve RTT for LDAP 
> requests
>  - for AD group membership is tested via memberOf queries and those groups 
> are being looked up via their DN instead of browsing
>  - generic LDAP support still falls back to iterating all groups according to 
> group search base with group search filter in subtree scope
>  - for setting up the group -> role mapping we still request all groups like 
> described above.
> 
> To answer some of the questions I really need to see the entire log output 
> during login tests, actual logins and logins which fail.
> If you cannot share them publicly, please feel free to send me an email at 
> k...@graylog.com 
> 
> Cheers,
> Kay
> 
>> On 10 Sep 2015, at 03:28, Jason Haar > > wrote:
>> 
>> I've also just reconfigured to point to one domain instead of the GC
>> forest (ie ActiveDirectory port 389) and reconfigured accordingly. Made
>> no difference - it still can create new accounts on first login attempt,
>> but the user still sees "credentials are invalid" and the backend still
>> can't get any group information - with the filter set to
>> "(objectClass=group)". As before, removing the filter entirely allows
>> the user to log in - but they can't do anything as you need the LDAP
>> groups to have come through and they haven't. The logs still report the
>> error
>> 
>> "ERR_04486_VALUE_ALREADY_EXISTS The value '20150319215008.0Z' already
>> exists in the attribute (dSCorePropagationData)"
>> 
>> ...so that might be the problem
>> 
>> -- 
>> Cheers
>> 
>> Jason Haar
>> Corporate Information Security Manager, Trimble Navigation Ltd.
>> Phone: +1 408 481 8171
>> PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
>> 
>> -- 
>> You received this message because you are subscribed to the Google Groups 
>> "Graylog Users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to graylog2+unsubscr...@googlegroups.com 
>> .
>> To view this discussion on the web visit 
>> https://groups.google.com/d/msgid/graylog2/55F0DCD9.6050308%40trimble.com 
>> .
>> For more options, visit https://groups.google.com/d/optout 
>> .
> 

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/4DB29551-3028-42C7-BDB6-9D7111629927%40gmail.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Updated Graylog Appliance 1.1.6

[Jochen Schalanda]

Hi James,

yes.

Cheers,
Jochen

On Wednesday, 16 September 2015 11:01:35 UTC+2, rogersmanau wrote:
>
> Hi All,
>
> Apologies if this has been asked previously. Is this still the correct 
> guidance to upgrade the Graylog appliance from 1.1.6 to the new 1.2GA? 
> http://docs.graylog.org/en/1.2/pages/installation/graylog_ctl.html#upgrade-graylog
>  
>
> Many Thanks,
> James.
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/ed7cba7c-6f6e-4201-b357-cf6f9180f521%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Anyone attempted to use AWS cloudsearch service to back graylog rather than clustering elasticsearch?

[Jochen Schalanda]

Hi Cory,

Graylog is currently pretty much tied in with Elasticsearch as its default 
output and for searches. Since AWS Cloudsearch isn't compatible with 
Elasticsearch, it's probably not easily possible to use that as a backend 
right now. It should be possible, though, to write a relatively simple AWS 
Cloudsearch Output plugin which, additionally to Elasticsearch, writes 
messages into AWS Cloudsearch. Anyway, please let us know how things worked 
out!

Cheers,
Jochen

On Tuesday, 15 September 2015 20:30:22 UTC+2, Cory Carlton wrote:
>
> Curious if anyone has attempted and the results. We are looking to vet 
> this idea out a bit.
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/1c42577d-17b3-4828-84a4-5ba30fdd3353%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [graylog2] Problem with streeam alerts after updating to graylog1.2

[Edmundo Alvarez]

We saw a similar problem with an alert callback that was created in 1.0, it 
could be the same problem that you are experiencing. Could you share with us 
your "alarmcallbackconfigurations" MongoDB collection in order to further 
investigate the issue? Please send it to edmu...@graylog.com if it contains any 
sensitive information.

In case you don't know how to get the collection, you can get the MongoDB 
collection by executing the following command in a terminal:
mongo :/ <<< 
'db.alarmcallbackconfigurations.find()'

Please remember to replace , , and 
 with the actual values for your environment. You may 
also need to add a username and password if your setup requires authentication.

Edmundo

> On 16 Sep 2015, at 13:09, Arie  wrote:
> 
> That is very well possible, 1.0 or 1.01 but not totally shore of it.
> 
> In one of the upgrades I had a problem with some data that was the result of 
> a Yum update from repository
> where old data was deleted an a wrong/missing node-id file.
> 
> We use the contend-pack function for backup of a lot of settings, an what I 
> see now is that the callback
> function is not present there, and may be missing in my present stream 
> configs.
> 
> Arie
> 
> Op woensdag 16 september 2015 11:45:55 UTC+2 schreef Edmundo Alvarez:
> That previous 1.1 version, was it an upgrade from 1.0 by any chance? 
> 
> Edmundo 
> 
> > On 16 Sep 2015, at 11:39, Arie  wrote: 
> > 
> > And second: 
> > 
> > In the alert the "callbacks" part in the GUI keeps "loading" going on 
> > endlesly. 
> > I remember editing the calback email condition so we are closer intho the 
> > problem I guess 
> > 
> > Arie 
> > 
> > Op woensdag 16 september 2015 11:22:52 UTC+2 schreef Edmundo Alvarez: 
> > Hi Arie, 
> > 
> > From which version did you upgrade to 1.2? It would also be helpful to know 
> > if that was a clean installation or an upgrade from an even earlier 
> > version. 
> > 
> > Regards, 
> > 
> > Edmundo 
> > 
> > > On 16 Sep 2015, at 11:10, Arie  wrote: 
> > > 
> > > I'dd had an error on producing the clone, but it appeard to be there. 
> > > After putting the receivers in it, 
> > > il looks like it is worrking. So whot is wrong with the original alerts. 
> > > ? 
> > > 
> > > 
> > > Op woensdag 16 september 2015 10:55:54 UTC+2 schreef Arie: 
> > > Cloning the stream is not possible either 
> > > 
> > > Op woensdag 16 september 2015 10:53:47 UTC+2 schreef Arie: 
> > > Hi, 
> > > 
> > > we are encountering problems with stream alerts after the update. 
> > > When editing/testing the alert condition we get this message in the GUI. 
> > > 
> > > Could not retrieve AlarmCallbacks 
> > > Fetching AlarmCallbacks failed with status: Internal Server Error 
> > > 
> > > 
> > > server logfile (partial): 
> > > 
> > >  ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource 
> > > com.mongodb.MongoException$Network: Read operation to server 
> > > localhost:27017 failed on database graylog2 
> > > at com.mongodb.DBTCPConnector.innerCall(DBTCPConnector.java:298) 
> > > at com.mongodb.DBTCPConnector.call(DBTCPConnector.java:269) 
> > > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:84) 
> > > at com.mongodb.DBCollectionImpl.find(DBCollectionImpl.java:66) 
> > > at com.mongodb.DBCursor._check(DBCursor.java:498) 
> > > at com.mongodb.DBCursor._hasNext(DBCursor.java:621) 
> > > at com.mongodb.DBCursor._fill(DBCursor.java:726) 
> > > at com.mongodb.DBCursor.toArray(DBCursor.java:763) 
> > > at org.mongojack.DBCursor.toArray(DBCursor.java:426) 
> > > at org.mongojack.DBCursor.toArray(DBCursor.java:411) 
> > > 
> > > 
> > > Caused by: com.fasterxml.jackson.databind.JsonMappingException: Can not 
> > > construct instance of java.lang.String, problem: Expected an ObjectId to 
> > > deserialise to string, but found class java.lang.String 
> > >  at [Source: 
> > > de.undercouch.bson4jackson.io.LittleEndianInputStream@2909ef06; pos: 21] 
> > > (through reference chain: 
> > > org.graylog2.alarmcallbacks.AlarmCallbackConfigurationAVImpl["id"]) 
> > > at 
> > > com.fasterxml.jackson.databind.JsonMappingException.from(JsonMappingException.java:148)
> > >  
> > > at 
> > > com.fasterxml.jackson.databind.DeserializationContext.instantiationException(DeserializationContext.java:889)
> > >  
> > > at 
> > > org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:55)
> > >  
> > > at 
> > > org.mongojack.internal.ObjectIdDeserializers$ToStringDeserializer.deserialize(ObjectIdDeserializers.java:37)
> > >  
> > > at 
> > > com.fasterxml.jackson.databind.deser.SettableBeanProperty.deserialize(SettableBeanProperty.java:520)
> > >  
> > > at 
> > > com.fasterxml.jackson.databind.deser.BeanDeserializer._deserializeWithErrorWrapping(BeanDeserializer.java:461)
> > >  
> > 

[graylog2] Re: Search Issue ...

[Drew Miranda]

Are you using the prebuilt filter via this method? Also are you using a 
relative or absolute time range search?

1. Find message that contains the field you want to filter by
2. Expand message by clicking (to show all fields with the Magnifying logo)
3. Click on the Magnifying logo for the field you want to filter, it will add 
that criteria to the search box

Does this filter differ from what you had already typed?

Also is you click on the "arrow pointing downward" next to that same field and 
select "show terms of..." does it show the words contained in the filename path?

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/711b7de6-9491-4972-9c4d-8b5689a48639%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [graylog2] Graylog shows no menu after login

[Edmundo Alvarez]

Hi Anant,

By the way you described the problem, there must be some error loading 
Javascript. Could you please take a look at the Javascript console in your 
browser and share any errors that you might see there? It would also be helpful 
knowing the browser and OS you use. Please also ensure that you are not using 
any plugin blocking Javascript execution for Graylog.

Regards,

Edmundo

> On 16 Sep 2015, at 18:58, Anant Sawant  wrote:
> 
> Hi!
> 
> I am running Graylog 1.1.6 server component and Graylog web component 1.1.6 
> which I have setup manually.
> I am running this on ubuntu 14.04.1. For this I have installed Elasticsearch 
> 1.7.2, mongodb version v3.0.6 and Java 1.8.0_60. The Graylog 1.1.6 server 
> component, Graylog web component 1.1.6, Mongod and Elasticsearch are on the 
> same machine. For configuration I have referred  
> http://docs.graylog.org/en/1.2/pages/installation/manual_setup.html#configuring-the-web-interface.
>  As per this document Graylog 1.1.6 server component and Graylog web 
> component 1.1.6 both are running well/as expected as I can see the expected 
> result on the console, also the logs shows no errors/exception. It also shows 
> the graylog login screen, but when I login using the credentials I see no 
> menu's, all I get is a simple page saying "graylog-web-interface v1.1.6 
> (2e264c2) (Oracle Corporation 1.8.0_60 / Linux 3.13.0-32-generic) on ubuntu 
> ". Why are the menus not visible??
> Is it because as I have not pointed the configured elasticsearch to syslog or 
> any other log system. Or is the issue with the configuration??
> I have attached the configuration files.
> 
> Please suggest or give me a idea to where to look for this issue.
> 
> Thanks in advance
> 
> Anant:-)
> 
> -- 
> You received this message because you are subscribed to the Google Groups 
> "Graylog Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to graylog2+unsubscr...@googlegroups.com.
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/graylog2/6683ee44-dda1-4869-b72e-d43471f8d81e%40googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.
> 

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/B118AA69-46B4-44B2-9644-C1010E29F80B%40graylog.com.
For more options, visit https://groups.google.com/d/optout.

[graylog2] Re: Updated Graylog Appliance 1.1.6

[rogersmanau]

Thanks Jochen. Went flawlessly. Very impressed!

On Wednesday, September 16, 2015 at 7:07:02 PM UTC+8, Jochen Schalanda 
wrote:
>
> Hi James,
>
> yes.
>
> Cheers,
> Jochen
>
> On Wednesday, 16 September 2015 11:01:35 UTC+2, rogersmanau wrote:
>>
>> Hi All,
>>
>> Apologies if this has been asked previously. Is this still the correct 
>> guidance to upgrade the Graylog appliance from 1.1.6 to the new 1.2GA? 
>> http://docs.graylog.org/en/1.2/pages/installation/graylog_ctl.html#upgrade-graylog
>>  
>>
>> Many Thanks,
>> James.
>>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/graylog2/4ae3418e-efc4-4de3-9063-6f7f4f1bf489%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.