no incoming logs after upgrade.

[benhank]

Upgraded to Nagios Log Server 2.0.8, and now I am not receiving any logs. I honestly think I messed up the process somehow. I am running NLS on a 2 node system.
I don't know how to check to see what might have gone wrong.
On a side note. all systems are green and the NLS services are running but i just don't have any new logs.

[npolovenko]

Hello, @benhank. Did you change the IP address on the log server or just updated it to the latest version?

Can you PM me a profile from the system so I can review it? The profile can be generated under Admin > System Status > Download System Profile.

[benhank]

no bro I didn't change the Ip I just ran the upgrade using the following commands:

Code: Select all

cd /tmp

rm -rf nagioslogserver nagioslogserver*.tar.gz

http://library.nagios.com/library/products/nagios-log-server/downloads/

wget http://assets.nagios.com/downloads/nagios-log-server/nagioslogserver-latest.tar.gz

curl -XPUT localhost:9200/_cluster/settings -d '
{
"transient" : {
"cluster.routing.allocation.enable" : "none"
}
}'

tar xzf nagioslogserver-latest.tar.gz

cd nagioslogserver/

./upgrade

curl -XPUT localhost:9200/_cluster/settings -d '
{
"transient" : {
"cluster.routing.allocation.enable" : "all"
}
}'

[npolovenko]

@benhank, Looks like the updated logstash plugin no longer supports the version of GeoLiteCity database you're using. Please download the newer version of the geoip database from here:
https://geolite.maxmind.com/download/ge ... ity.tar.gz
Extract the GeoLite2-City.mmdb file to the /usr/share/GeoIP/ folder and change the database path in the geoip filter to:

Code: Select all

 geoip {
    database => "/usr/share/GeoIP/GeoLite2-City.mmdb"
    source => "IPAddress"
    }

 geoip {
    database => "/usr/share/GeoIP/GeoLite2-City.mmdb"
    source => "IpAddress"
    }

[benhank]

Hey man thanks!
I gotta admit I was skeptical to try it, but I thought to myself" they haven't steered you wrong yet, so do it" and it worked logs are coming in now appreciate the help man!

[scottwilkerson]

Hey man thanks!
I gotta admit I was skeptical to try it, but I thought to myself" they haven't steered you wrong yet, so do it" and it worked logs are coming in now appreciate the help man!

great!

Locking thread