Changing Global Settings

[gary80918]

I have tried several times to add and/or change a global setting and it never gets passed the Verify. I want to change the syslog port from 5544 to 514.
syslog {
type => 'syslog'
port => 5544
}

to

syslog {
type => 'syslog'
port => 514
}


I have even added and still fails the Verify.

Am I doing something wrong:

the logs shows::
The bundle currently has logstash-input-tcp locked at 3.0.6.
Try running `bundle update logstash-input-tcp`
verify_gemfile_dependencies_are_found! at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/resolver.rb:328
each at org/jruby/RubyArray.java:1613
verify_gemfile_dependencies_are_found! at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/resolver.rb:307
start at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/resolver.rb:199
resolve at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/resolver.rb:182
resolve at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/definition.rb:192
specs at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/definition.rb:132
specs_for at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/definition.rb:177
requested_specs at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/definition.rb:166
requested_specs at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/environment.rb:18
setup at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/runtime.rb:13
setup at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler.rb:122
setup! at /usr/local/nagioslogserver/logstash/lib/bootstrap/bundler.rb:64
(root) at /usr/local/nagioslogserver/logstash/lib/bootstrap/environment.rb:65
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (6) Could not resolve host: www.nagios.com; Unknown error

[cdienger]

Port 514 is considered a privileged port and steps need to be taken to allow an input to listen on the port. See https://assets.nagios.com/downloads/nag ... Server.pdf if you haven't already done so.

The message in the log - are you seeing that when you try to apply configuration? It seems like a separate issue that changing the port number of an existing input shouldn't cause.

What version of NLS is this?

Is port 514 already in use on the NLS server? Run "netstat -nap | grep 514" to see if it is in use.

[gary80918]

The NLS version is the latest running on RHEL 7. I found a version file in the offline files I used to do the install, it says 2008. However, honestly I really do not know the version.


Is port 514 already in use on the NLS server? Run "netstat -nap | grep 514" to see if it is in use. No it is not in use:
root@hpsatvld5352:/etc/httpd/conf.d # netstat -nap | grep 514
root@hpsatvld5352:/etc/httpd/conf.d #

[gary80918]

I think I found the version: Nagios Log Server 2.0.8

[cdienger]

When/where are you seeing the message regarding the logstash-input-tcp being locked at 3.0.6? It should be at 4.2.4 on a 2.0.8 version of NLS.

Run the following to get the current version of this and the geoip filter(both are updated in 2.0.8).

/usr/local/nagioslogserver/logstash/bin/logstash-plugin list --verbose | grep -E 'tcp|geo'

also check /usr/local/nagioslogserver/logstash/Gemfile - it should have two lines that control the version of logstash-input-tcp and logstash-filter-geoip that look like:

Code: Select all

gem "logstash-input-tcp", "~>4"
gem "logstash-filter-geoip", "4.0.4"

If the installed tcp input and geoip filter are not 4.2.4 and 4.0.4, then you'll need to download the new versions, move them to the /tmp directory of the NLS machine, and install them.

Download:

Code: Select all

wget https://rubygems.org/downloads/logstash-input-tcp-4.2.4-java.gem
wget https://rubygems.org/downloads/logstash-filter-geoip-4.0.4-java.gem

Install:

Code: Select all

/usr/local/nagioslogserver/logstash/bin/logstash-plugin install --local /tmp/logstash-input-tcp-4.2.4-java.gem /tmp/logstash-filter-geoip-4.0.4-java.gem

[gary80918]

Thank you that fixed the problem:


PRE-UPDATE:

root@hpsatvld5352:~ # /usr/local/nagioslogserver/logstash/bin/logstash-plugin list --verbose | grep -E 'tcp|geo'
Bundler::GemNotFound: You have requested:
logstash-input-tcp ~> 4

The bundle currently has logstash-input-tcp locked at 3.0.6.
Try running `bundle update logstash-input-tcp`
verify_gemfile_dependencies_are_found! at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/resolver.rb:328
each at org/jruby/RubyArray.java:1613
verify_gemfile_dependencies_are_found! at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/resolver.rb:307
start at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/resolver.rb:199
resolve at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/resolver.rb:182
resolve at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/definition.rb:192
specs at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/definition.rb:132
specs_for at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/definition.rb:177
requested_specs at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/definition.rb:166
requested_specs at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/environment.rb:18
setup at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/runtime.rb:13
setup at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler.rb:122
setup! at /usr/local/nagioslogserver/logstash/lib/bootstrap/bundler.rb:64
execute at /usr/local/nagioslogserver/logstash/lib/pluginmanager/list.rb:17
run at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67
execute at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/subcommand/execution.rb:11
run at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67
run at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132
(root) at /usr/local/nagioslogserver/logstash/lib/pluginmanager/main.rb:43


root@hpsatvld5352:~ # grep -E 'input-tcp|filter-geoip' /usr/local/nagioslogserver/logstash/Gemfile
gem "logstash-input-tcp", "~>4"
gem "logstash-filter-geoip", "4.0.4"




Updating teh gem files:

root@hpsatvld5352:~ # /usr/local/nagioslogserver/logstash/bin/logstash-plugin install --local /tmp/logstash-input-tcp-4.2.4-java.gem /tmp/logstash-filter-geoip-4.0.4-java.gem
Validating /tmp/logstash-input-tcp-4.2.4-java.gem
Validating /tmp/logstash-filter-geoip-4.0.4-java.gem
Installing logstash-input-tcp, logstash-filter-geoip




After Update:
root@hpsatvld5352:~ # /usr/local/nagioslogserver/logstash/bin/logstash-plugin list --verbose | grep -E 'tcp|geo'
Gem::LoadError: You have already activated minitar 0.6.1, but your Gemfile requires minitar 0.5.4. Prepending `bundle exec` to your command may solve this.
setup at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/runtime.rb:34
each at org/jruby/RubyArray.java:1613
each at /usr/local/nagioslogserver/logstash/vendor/jruby/lib/ruby/1.9/forwardable.rb:201
setup at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler/runtime.rb:19
setup at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/bundler-1.9.10/lib/bundler.rb:122
setup! at /usr/local/nagioslogserver/logstash/lib/bootstrap/bundler.rb:64
execute at /usr/local/nagioslogserver/logstash/lib/pluginmanager/list.rb:17
run at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67
execute at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/subcommand/execution.rb:11
run at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67
run at /usr/local/nagioslogserver/logstash/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132
(root) at /usr/local/nagioslogserver/logstash/lib/pluginmanager/main.rb:43

root@hpsatvld5352:~ # grep -E 'input-tcp|filter-geoip' /usr/local/nagioslogserver/logstash/Gemfile
gem "logstash-input-tcp", "4.2.4", :path => "vendor/local_gems/8e0d39b3/logstash-input-tcp-4.2.4-java"
gem "logstash-filter-geoip", "4.0.4", :path => "vendor/local_gems/87c2f2ad/logstash-filter-geoip-4.0.4-java"


I was able to make the syslog port change from 5544 to 514.

[scottwilkerson]

I was able to make the syslog port change from 5544 to 514.

Great!

Locking thread