[graylog2] [UpdateRegistration] Failed to report collector status to

[NeefRoel]

Hi,

I've installed the graylog server version 2.2.0-11 on one server and the
collector-sidecar v0.0.9-1 on another.
I have succesfully send log events to the graylog server and am able to see
them.

I was now finetuning the client and I noticed that the client is telling me
that it is unable to report its status to the server, eg;

ERRO[0010] [UpdateRegistration] Failed to report collector status to server:
<nil>


When running manually from the commandline;
INFO[0000] Using collector-id: 8e3deae7-4312-498e-aa42-0d5d2dd521e9
INFO[0000] Fetching configurations tagged by: [linux apache]
INFO[0000] Starting collector supervisor
INFO[0000] [filebeat] Starting
INFO[0010] [filebeat] Configuration change detected, rewriting
configuration file.
ERRO[0010] [UpdateRegistration] Failed to report collector status to
server: <nil>
INFO[0010] [filebeat] Stopping
INFO[0014] [filebeat] Starting
ERRO[0020] [UpdateRegistration] Failed to report collector status to
server: <nil>
^CINFO[0029] [filebeat] Stopping
ERRO[0030] [UpdateRegistration] Failed to report collector status to
server: <nil>


I noticed in other topics that this would be the server_url variable. But
when I change this to an incorrect value I get a 404 response..e.g.
ERRO[0010] [RequestConfiguration] Bad response status from Graylog server:
404 Not Found

The URL i've configured is;
server_url: http://my.fqdn.hostname/api/

I've used tcpdump to see what is going on, and I can see it is posting
(HTTP PUT) data;
PUT /api/plugins/org.graylog.plugins.collector/collectors/8e3deae7-4312-498e
-aa42-0d5d2dd521e9 HTTP/1.1
Host: my.fqdn.hostname
User-Agent: Graylog Collector v0.0.9
Content-Length: 312
Accept: application/json
Content-Type: application/json
X-Graylog-Collector-Version: 0.0.9


{"node_id":"graylog-collector-sidecar","node_details":{"operating_system":
"Linux","tags":["linux","apache"],"ip":"My.Ip.Add.ress","metrics":{
"disks_75":[],"cpu_idle":97.61999999999999,"load_1":0.07},"status":{
"backends":{"filebeat":{"status":0,"message":"Running"}},"status":0,
"message":"1 collectors running"}}}


I'm also receiving a response;
HTTP/1.1 202 Accepted
Date: Mon, 20 Feb 2017 10:54:00 GMT
Server: Apache
X-Graylog-Node-ID: 178b5821-23e3-493c-9c21-13d6414d4193
X-Runtime-Microseconds: 7341
Content-Type: application/json
Content-Length: 105

{"configuration":{"update_interval":30,"send_status":true},"configuration_override":false,"actions":

I'm using Debian Jessie on both servers.. Anyone got an idea why I'm
receiving these messages and what I can to fix that?

(ps. the graylog server is running behind a reverse proxy, but even when
accessing it directly I get this message..)

Cheers,
NeefRoel

[Marius Sturm]

Hi,
the Graylog api is typically listening on port 9000, so the server_url
is most likely: http://my.fqdn.hostname:9000/api/

Cheers,
Marius

Post by NeefRoel
Hi,
I've installed the graylog server version 2.2.0-11 on one server and the
collector-sidecar v0.0.9-1 on another.
I have succesfully send log events to the graylog server and am able to see
them.
I was now finetuning the client and I noticed that the client is telling me
that it is unable to report its status to the server, eg;
<nil>
When running manually from the commandline;
INFO[0000] Using collector-id: 8e3deae7-4312-498e-aa42-0d5d2dd521e9
INFO[0000] Fetching configurations tagged by: [linux apache]
INFO[0000] Starting collector supervisor
INFO[0000] [filebeat] Starting
INFO[0010] [filebeat] Configuration change detected, rewriting configuration
file.
<nil>
INFO[0010] [filebeat] Stopping
INFO[0014] [filebeat] Starting
<nil>
^CINFO[0029] [filebeat] Stopping
<nil>
I noticed in other topics that this would be the server_url variable. But
when I change this to an incorrect value I get a 404 response..e.g.
404 Not Found
The URL i've configured is;
server_url: http://my.fqdn.hostname/api/
I've used tcpdump to see what is going on, and I can see it is posting (HTTP
PUT) data;
PUT
/api/plugins/org.graylog.plugins.collector/collectors/8e3deae7-4312-498e-aa42-0d5d2dd521e9
HTTP/1.1
Host: my.fqdn.hostname
User-Agent: Graylog Collector v0.0.9
Content-Length: 312
Accept: application/json
Content-Type: application/json
X-Graylog-Collector-Version: 0.0.9
{"node_id":"graylog-collector-sidecar","node_details":{"operating_system":"Linux","tags":["linux","apache"],"ip":"My.Ip.Add.ress","metrics":{"disks_75":[],"cpu_idle":97.61999999999999,"load_1":0.07},"status":{"backends":{"filebeat":{"status":0,"message":"Running"}},"status":0,"message":"1
collectors running"}}}
I'm also receiving a response;
HTTP/1.1 202 Accepted
Date: Mon, 20 Feb 2017 10:54:00 GMT
Server: Apache
X-Graylog-Node-ID: 178b5821-23e3-493c-9c21-13d6414d4193
X-Runtime-Microseconds: 7341
Content-Type: application/json
Content-Length: 105
I'm using Debian Jessie on both servers.. Anyone got an idea why I'm
receiving these messages and what I can to fix that?
(ps. the graylog server is running behind a reverse proxy, but even when
accessing it directly I get this message..)
Cheers,
NeefRoel
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/8ca05052-451c-485f-a54b-675efb009c53%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--
Developer

Tel.: [phone]
Fax.: [phone]

TORCH GmbH - A Graylog Company
Poolstraße 21
20335 Hamburg
Germany

https://www.graylog.com

Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175
Geschäftsführer: Lennart Koopmann (CEO)

[NeefRoel]

Thanks for the quick response.
But as I said, the service is running behind a reverse proxy, which proxies
the tcp 80 to tcp 9000.

Even so.. Because this is the 'first' server I've also used a direct link
to this server over port 9000, which results in the same messages being
logged.

Cheers,
NeefRoel

Post by Marius Sturm
Hi,
the Graylog api is typically listening on port 9000, so the server_url
is most likely: http://my.fqdn.hostname:9000/api/
Cheers,
Marius

Post by NeefRoel
Hi,
I've installed the graylog server version 2.2.0-11 on one server and the
collector-sidecar v0.0.9-1 on another.
I have succesfully send log events to the graylog server and am able to

see

Post by NeefRoel
them.
I was now finetuning the client and I noticed that the client is telling

me

Post by NeefRoel
that it is unable to report its status to the server, eg;
ERRO[0010] [UpdateRegistration] Failed to report collector status to
<nil>
When running manually from the commandline;
INFO[0000] Using collector-id: 8e3deae7-4312-498e-aa42-0d5d2dd521e9
INFO[0000] Fetching configurations tagged by: [linux apache]
INFO[0000] Starting collector supervisor
INFO[0000] [filebeat] Starting
INFO[0010] [filebeat] Configuration change detected, rewriting

configuration

Post by NeefRoel
file.
ERRO[0010] [UpdateRegistration] Failed to report collector status to
<nil>
INFO[0010] [filebeat] Stopping
INFO[0014] [filebeat] Starting
ERRO[0020] [UpdateRegistration] Failed to report collector status to
<nil>
^CINFO[0029] [filebeat] Stopping
ERRO[0030] [UpdateRegistration] Failed to report collector status to
<nil>
I noticed in other topics that this would be the server_url variable.

But

Post by NeefRoel
when I change this to an incorrect value I get a 404 response..e.g.
ERRO[0010] [RequestConfiguration] Bad response status from Graylog
404 Not Found
The URL i've configured is;
server_url: http://my.fqdn.hostname/api/
I've used tcpdump to see what is going on, and I can see it is posting

(HTTP

Post by NeefRoel
PUT) data;
PUT

/api/plugins/org.graylog.plugins.collector/collectors/8e3deae7-4312-498e-aa42-0d5d2dd521e9

Post by NeefRoel
HTTP/1.1
Host: my.fqdn.hostname
User-Agent: Graylog Collector v0.0.9
Content-Length: 312
Accept: application/json
Content-Type: application/json
X-Graylog-Collector-Version: 0.0.9

{"node_id":"graylog-collector-sidecar","node_details":{"operating_system":"Linux","tags":["linux","apache"],"ip":"My.Ip.Add.ress","metrics":{"disks_75":[],"cpu_idle":97.61999999999999,"load_1":0.07},"status":{"backends":{"filebeat":{"status":0,"message":"Running"}},"status":0,"message":"1

Post by NeefRoel
collectors running"}}}
I'm also receiving a response;
HTTP/1.1 202 Accepted
Date: Mon, 20 Feb 2017 10:54:00 GMT
Server: Apache
X-Graylog-Node-ID: 178b5821-23e3-493c-9c21-13d6414d4193
X-Runtime-Microseconds: 7341
Content-Type: application/json
Content-Length: 105
I'm using Debian Jessie on both servers.. Anyone got an idea why I'm
receiving these messages and what I can to fix that?
(ps. the graylog server is running behind a reverse proxy, but even when
accessing it directly I get this message..)
Cheers,
NeefRoel
--
You received this message because you are subscribed to the Google

Groups

Post by NeefRoel
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send

an

Post by NeefRoel
To view this discussion on the web visit

https://groups.google.com/d/msgid/graylog2/8ca05052-451c-485f-a54b-675efb009c53%40googlegroups.com.

Post by NeefRoel
For more options, visit https://groups.google.com/d/optout.

--
Developer
Tel.: [phone]
Fax.: [phone]
TORCH GmbH - A Graylog Company
Poolstraße 21
20335 Hamburg
Germany
https://www.graylog.com
Commercial Reg. (Registergericht): Amtsgericht Hamburg, HRB 125175
GeschÀftsfÌhrer: Lennart Koopmann (CEO)

[NeefRoel]

Thanks for the quick response.
But as I said, the service is running behind a reverse proxy, which proxies
the tcp 80 to tcp 9000.

Even so.. Because this is the 'first' server I've also used a direct link
to this server over port 9000, which results in the same messages being
logged.

Cheers,
NeefRoel