Page 2 of 3
Re: _grokparsefailure on all events
Posted: Tue Feb 10, 2015 9:39 am
by scottwilkerson
vAJ wrote:Even when I save and applied changes, these timestamps did not update.
If the timestamps aren't updating when you apply configuration there must be a permissions problem.
Lets apply configuration again and then run the following
Code: Select all
ls -la /usr/local/nagioslogserver/logstash/etc/conf.d
ls -la /usr/local/nagioslogserver/logstash/
ls -la /usr/local/nagioslogserver/
Re: _grokparsefailure on all events
Posted: Tue Feb 10, 2015 3:12 pm
by vAJ
Code: Select all
total 20
drwxrwxr-x. 2 nagios nagios 4096 Feb 6 23:59 .
drwxrwxr-x. 3 nagios nagios 4096 Oct 10 23:01 ..
-rwxrwxr-x 1 nagios nagios 786 Feb 5 00:01 000_inputs.conf
-rwxrwxr-x 1 nagios nagios 1590 Feb 5 00:01 500_filters.conf
-rwxrwxr-x 1 nagios nagios 493 Feb 5 00:01 999_outputs.conf
Code: Select all
total 44
drwxrwxr-x. 9 nagios nagios 4096 Oct 10 23:01 .
drwxrwxr-x. 10 nagios nagios 4096 Feb 11 00:02 ..
drwxrwxr-x. 2 nagios nagios 4096 Oct 10 23:01 bin
drwxrwxr-x. 3 nagios nagios 4096 Oct 10 23:01 etc
drwxrwxr-x. 3 nagios nagios 4096 Oct 10 23:01 lib
-rwxrwxr-x. 1 nagios nagios 591 Oct 10 23:01 LICENSE
drwxrwxr-x. 2 nagios nagios 4096 Oct 10 23:01 locales
drwxrwxr-x. 2 nagios nagios 4096 Oct 10 23:01 patterns
-rwxrwxr-x. 1 nagios nagios 3450 Oct 10 23:01 README.md
drwxrwxr-x. 10 nagios nagios 4096 Oct 10 23:01 spec
drwxrwxr-x. 8 nagios nagios 4096 Oct 10 23:01 vendor
Code: Select all
total 40
drwxrwxr-x. 10 nagios nagios 4096 Feb 11 00:02 .
drwxr-xr-x. 14 root root 4096 Jan 30 20:09 ..
drwxrwxr-x. 7 nagios nagios 4096 Oct 10 23:01 elasticsearch
drwxrwxr-x. 2 nagios nagios 4096 Oct 10 23:00 etc
drwxrwxr-x. 9 nagios nagios 4096 Oct 10 23:01 logstash
drwxrwxr-x. 2 nagios nagios 4096 Oct 10 23:00 mibs
drwxrwxr-x. 2 nagios nagios 4096 Jan 22 02:26 scripts
drwxrwxr-x. 2 nagios nagios 4096 Feb 11 00:02 snapshots
drwxrwxr-x. 3 nagios nagios 4096 Feb 11 00:02 tmp
drwxrwxr-x. 2 nagios nagios 4096 Oct 21 00:46 var
Re: _grokparsefailure on all events
Posted: Tue Feb 10, 2015 5:54 pm
by scottwilkerson
Well, that all looks correct.
When you apply the configuration do you get the message the the configuration applied successfully?
Re: _grokparsefailure on all events
Posted: Tue Feb 10, 2015 6:06 pm
by vAJ
No errors are presented. But then again, no obvious success message either...
Re: _grokparsefailure on all events
Posted: Wed Feb 11, 2015 10:51 am
by scottwilkerson
It certainly should have a success message, if it is re-directing you to the snapshots page, you may need to click Apply Configuration again on the left and then Apply
Re: _grokparsefailure on all events
Posted: Wed Feb 11, 2015 11:12 am
by vAJ
Got the success message on the retry, but the conf files all have the same stamp as before.
Re: _grokparsefailure on all events
Posted: Wed Feb 11, 2015 5:58 pm
by tmcdonald
Our of curiosity, are you getting anything in /var/log/httpd/error_log when you do the apply?
Re: _grokparsefailure on all events
Posted: Thu Feb 12, 2015 10:13 am
by vAJ
Nadda. The last entries in the log are:
Code: Select all
[Sun Feb 08 03:35:02 2015] [notice] Digest: generating secret for digest authentication ...
[Sun Feb 08 03:35:02 2015] [notice] Digest: done
[Sun Feb 08 03:35:02 2015] [notice] Apache/2.2.15 (Unix) DAV/2 PHP/5.3.3 configured -- resuming normal operations
Re: _grokparsefailure on all events
Posted: Thu Feb 12, 2015 6:03 pm
by tmcdonald
Would you want to open a ticket for this? We might need to move this to a remote session at some point.
Re: _grokparsefailure on all events
Posted: Thu Feb 12, 2015 6:07 pm
by vAJ
I haven't bought it yet...

But I'm good for it, right? Katie has my back on this...
Let's try to setup something for tomorrow (Friday) morning.