Changed data location and now not working

[BanditBBS]

I followed the docs to change data location and now my log server is not working. I can start the eleasticsearch service but logserver thinks both elasticsearch and logstash are both not up.

[tmcdonald]

I had some issues with the doc as I was testing it but nothing relating to this. The problem I ran into was related to changed permissions after the moving of the existing data. Does the logstash service start up correctly?

[BanditBBS]

Both logstash and eleasticsearch show as running at the cli but logserver thinks they are both down.

[tmcdonald]

Might not be able to find the PIDs. What directory/directories did you move? Just what was mentioned in the doc? And where did you move them to?

[BanditBBS]

I only did exactly what the doc said

I created a new folder under /var/local and made nagios the owner. I then performed the move to move the data file from original location to the new one and verified permissions. I then started the elasticsearch service. I even rebooted the server and no change. Both services say running and nagios logserver says both are down.

EDIT: I just undid my changes and it still wont work

[tmcdonald]

Are you still getting logs properly? Able to query them, filter, etc?

I think this might be two issues/possible bugs hitting at the same time.

[eloyd]

For fun, if you smylink the new place to the old place, does it work?

[BanditBBS]

Are you still getting logs properly? Able to query them, filter, etc?

I think this might be two issues/possible bugs hitting at the same time.

I am getting logs as the home page shows new events. Doesn't look like I can query. This is a fresh install, no external logs yet, just the default configuration. As stated in previous post edit, I undid my data folder location change and issues persists.

[tmcdonald]

Can you try adding a new source from like an Apache server and see if it picks it up? And when you go to query, what happens? Does the query just not get applied and the output doesn't change? Or does it not search for the right things?

Edit: I'm testing this currently. Will update.

Edit 2: Can you try running "/etc/init.d/logstash status" and "/etc/init.d/elasticsearch status" as the nagios and apache users?

[BanditBBS]

Code: Select all

[jclark@iss-chi-nag07 ~]$ sudo su -
[root@iss-chi-nag07 ~]# sudo su - nagios
[nagios@iss-chi-nag07 ~]$ /etc/init.d/logstash status
You need root privileges to run this script
[nagios@iss-chi-nag07 ~]$ exit
logout
[root@iss-chi-nag07 ~]# sudo su - apache
This account is currently not available.
[root@iss-chi-nag07 ~]#