No custome queries in management?

[jsharris]

I saved a user query and it shows up on the home page under My Queries, however when I go to my dashboard and open Manage Queries nothing is present but those created with the installation. How can I manage the queries I create and save correctly?

[jolson]

The 'Manage Queries' menu should show you the same information that you see on your home screen.

How did you create your query? I'd like to try and replicate this behavior.

The most typical way to make a query is to design an appopriate dashboard, and then save that dashboard as a query using the 'Manage Queries' menu:

[jsharris]

I was working in the default dashboard and setup a test query. Opened the manage queries menu, entered a name, and saved it as a non-global query.

Strangely enough, I came in this morning and took a look after seeing your response and my query is now listed. Is there a scheduled process that controls when the queries appear in the available queries list? Similarly, clicking on the delete icon prompts for confirmation but after clicking OK the query is still listed in query management but it is not on the home page (tried logging out, closing the browser, opening new browser, and logging in but no change).

[jolson]

Interesting. In all of my testing, the query appeared immediately after I clicked the 'Save' icon, and disappeared immediately after I clicked the 'delete' icon.

I would like to know a few things about your environment.

What version of NLS are you running?

Plesae show me the output of the following commands:

Code: Select all

free -m
curl 'localhost:9200/_cluster/health?level=indices&pretty'
curl -s localhost:9200/_cat/shards | grep UNASS
curl 'localhost:9200/_cat/nodes?v'
curl -XGET localhost:9200/_nodes/jvm?pretty

[jsharris]

It is version 1.3.0. I have attached the output for the commands you requested as well. As an additional oddity when attempting to gather that information I was getting a lot of can't connect to host errors returned by the command. Tried to log into the GUI and I could not as the elasticsearch service was not running (can't log in to the GUI without that?). Started the service and after a couple of commands it had stopped again. Restarted and logged into the GUI and found the logstash collector service was also not running. Started that.

This is a VM deployed via OVF and currently only gathering information from two hosts aside from itself (one Windows 7 workstation which does nothing and a production file server). The only configuration changes made so far are configuration of the mail server settings and LDAP import of a few users. Is it common for the services to stop without warning or apparent reason?

[jolson]

Is it common for the services to stop without warning or apparent reason?

It is not common. The likely cause of your issues is the fact that you have 2GB of memory allocated to this machine - this idea is supported by the fact that the elasticsearch service has been dying on you. Try upping the amount of memory in your machine to 4GB and restarting the elasticsearch service.

Code: Select all

service elasticsearch restart

If my understanding of your system is correct, you should be good to go from that point on. Keep in mind that as more hosts log to Nagios Log Server, you will need to scale up the amount of memory/CPUs accordingly. I worked with a client today who had two 6CPU/10GB RAM nodes that were taking in over 15GB of log data per day - just to give you an idea of how to scale your server. Of course there are many other variables to consider.

Best,


Jesse

[jsharris]

Deleted and redeployed as I could no longer access any information (exceeded license; new server is using the 60 day trial as we are in the process of evaluating and did not realize that applying the free license would render the server unusable once 500MB was reached in a given day). I have increased the resources assigned to 8GB RAM and 4 CPUs (2 sockets, 2 cores per socket).

The original problem remains; saved queries do not appear in query management upon creation but do show up on the home page under My Queries. This is what I see:

QueryMismatch.jpg

[jolson]

I'm not sure why this is happening. I think that a remote session would help us dig into the root cause of this issue. Would you please email [email protected] with a link to this thread? I'll grab the ticket and we can get a remote going this Friday if you have the time.

[jsharris]

Posting follow-up for anyone else who comes across this problem. There is a bug involving IE and Nagios Log Server which is currently being investigated. The workaround is to use another browser until it is fixed.

[jolson]

This bug has been fixed internally and will be included in the next release. Thanks for the follow-up jsharris!