Page 2 of 3

Re: _grokparsefailure on all events

Posted: Tue Feb 10, 2015 9:39 am
by scottwilkerson
vAJ wrote:Even when I save and applied changes, these timestamps did not update.
If the timestamps aren't updating when you apply configuration there must be a permissions problem.

Lets apply configuration again and then run the following

Code: Select all

ls -la /usr/local/nagioslogserver/logstash/etc/conf.d
ls -la /usr/local/nagioslogserver/logstash/
ls -la /usr/local/nagioslogserver/

Re: _grokparsefailure on all events

Posted: Tue Feb 10, 2015 3:12 pm
by vAJ

Code: Select all

total 20
drwxrwxr-x. 2 nagios nagios 4096 Feb  6 23:59 .
drwxrwxr-x. 3 nagios nagios 4096 Oct 10 23:01 ..
-rwxrwxr-x  1 nagios nagios  786 Feb  5 00:01 000_inputs.conf
-rwxrwxr-x  1 nagios nagios 1590 Feb  5 00:01 500_filters.conf
-rwxrwxr-x  1 nagios nagios  493 Feb  5 00:01 999_outputs.conf

Code: Select all

total 44
drwxrwxr-x.  9 nagios nagios 4096 Oct 10 23:01 .
drwxrwxr-x. 10 nagios nagios 4096 Feb 11 00:02 ..
drwxrwxr-x.  2 nagios nagios 4096 Oct 10 23:01 bin
drwxrwxr-x.  3 nagios nagios 4096 Oct 10 23:01 etc
drwxrwxr-x.  3 nagios nagios 4096 Oct 10 23:01 lib
-rwxrwxr-x.  1 nagios nagios  591 Oct 10 23:01 LICENSE
drwxrwxr-x.  2 nagios nagios 4096 Oct 10 23:01 locales
drwxrwxr-x.  2 nagios nagios 4096 Oct 10 23:01 patterns
-rwxrwxr-x.  1 nagios nagios 3450 Oct 10 23:01 README.md
drwxrwxr-x. 10 nagios nagios 4096 Oct 10 23:01 spec
drwxrwxr-x.  8 nagios nagios 4096 Oct 10 23:01 vendor

Code: Select all

total 40
drwxrwxr-x. 10 nagios nagios 4096 Feb 11 00:02 .
drwxr-xr-x. 14 root   root   4096 Jan 30 20:09 ..
drwxrwxr-x.  7 nagios nagios 4096 Oct 10 23:01 elasticsearch
drwxrwxr-x.  2 nagios nagios 4096 Oct 10 23:00 etc
drwxrwxr-x.  9 nagios nagios 4096 Oct 10 23:01 logstash
drwxrwxr-x.  2 nagios nagios 4096 Oct 10 23:00 mibs
drwxrwxr-x.  2 nagios nagios 4096 Jan 22 02:26 scripts
drwxrwxr-x.  2 nagios nagios 4096 Feb 11 00:02 snapshots
drwxrwxr-x.  3 nagios nagios 4096 Feb 11 00:02 tmp
drwxrwxr-x.  2 nagios nagios 4096 Oct 21 00:46 var

Re: _grokparsefailure on all events

Posted: Tue Feb 10, 2015 5:54 pm
by scottwilkerson
Well, that all looks correct.

When you apply the configuration do you get the message the the configuration applied successfully?

Re: _grokparsefailure on all events

Posted: Tue Feb 10, 2015 6:06 pm
by vAJ
No errors are presented. But then again, no obvious success message either...

Re: _grokparsefailure on all events

Posted: Wed Feb 11, 2015 10:51 am
by scottwilkerson
It certainly should have a success message, if it is re-directing you to the snapshots page, you may need to click Apply Configuration again on the left and then Apply

Re: _grokparsefailure on all events

Posted: Wed Feb 11, 2015 11:12 am
by vAJ
Got the success message on the retry, but the conf files all have the same stamp as before.

Re: _grokparsefailure on all events

Posted: Wed Feb 11, 2015 5:58 pm
by tmcdonald
Our of curiosity, are you getting anything in /var/log/httpd/error_log when you do the apply?

Re: _grokparsefailure on all events

Posted: Thu Feb 12, 2015 10:13 am
by vAJ
Nadda. The last entries in the log are:

Code: Select all

[Sun Feb 08 03:35:02 2015] [notice] Digest: generating secret for digest authentication ...
[Sun Feb 08 03:35:02 2015] [notice] Digest: done
[Sun Feb 08 03:35:02 2015] [notice] Apache/2.2.15 (Unix) DAV/2 PHP/5.3.3 configured -- resuming normal operations

Re: _grokparsefailure on all events

Posted: Thu Feb 12, 2015 6:03 pm
by tmcdonald
Would you want to open a ticket for this? We might need to move this to a remote session at some point.

Re: _grokparsefailure on all events

Posted: Thu Feb 12, 2015 6:07 pm
by vAJ
I haven't bought it yet... ;) But I'm good for it, right? Katie has my back on this...

Let's try to setup something for tomorrow (Friday) morning.