GeoIP plugin issues after upgrade
Posted: Fri Jul 26, 2019 2:24 pm
Gentlemen, good night.
After reviewing the release notes of the latest versions of Nagio Log Server; We have decided to upgrade our cluster from version 2.0.6 to version 2.0.8.
The update occurred normally; however after upgrade the logstash service does not start.
We had the cluster down for a few hours; while we investigate the issue.
We found that version 2.0.6 uses the "logstash-filter-geoip-2.0.8" plugin (which works with MaxMind's LEGACY databases).
The latest version 2.0.8 comes with the "logstash-filter-geoip-4.0.4" plugin (which works with MaxMind's MMDB databases).
Thus, the logstash service could not read the database file; because I thought the file was corrupt.
To resolve; we download the latest version of GeoLite2; and overwrite the file that was mapped in our plugins. (https://dev.maxmind.com/geoip/geoip2/geolite2/)
It is regrettable that important modifications such as this are not documented in the product release notes. We had a serious indictment with our infrastructure; resulting in log loss. The problem was not noticed after the upgrade; because it did not generate immediate errors. Thus we proceed with the cluster update; that was compromised.
After reviewing the release notes of the latest versions of Nagio Log Server; We have decided to upgrade our cluster from version 2.0.6 to version 2.0.8.
The update occurred normally; however after upgrade the logstash service does not start.
We had the cluster down for a few hours; while we investigate the issue.
We found that version 2.0.6 uses the "logstash-filter-geoip-2.0.8" plugin (which works with MaxMind's LEGACY databases).
The latest version 2.0.8 comes with the "logstash-filter-geoip-4.0.4" plugin (which works with MaxMind's MMDB databases).
Thus, the logstash service could not read the database file; because I thought the file was corrupt.
To resolve; we download the latest version of GeoLite2; and overwrite the file that was mapped in our plugins. (https://dev.maxmind.com/geoip/geoip2/geolite2/)
It is regrettable that important modifications such as this are not documented in the product release notes. We had a serious indictment with our infrastructure; resulting in log loss. The problem was not noticed after the upgrade; because it did not generate immediate errors. Thus we proceed with the cluster update; that was compromised.