Page 1 of 1

Nagios LS - Stops working after a few days

Posted: Mon Oct 14, 2019 1:50 am
by dariusz.nalazek
Hello,
I'm testing Nagios LS, before purchase. Now I have simple installation 2-node LS, 4vCPU, 8GB RAM VMs @ ESXi. (OVA installation with all patches, latest LS version)
Client servers forward logs to the DNS's round robin name.
It's 17th day of tests, and so far the Nagios LS 3rd time stops receiving any logs, no new indexes are created. To force it working again I have to restart both nodes. Then again Nagios LS works for some period of time.
Now I have connected just a few servers as clients (14 hosts, ~40GB per day), installation target (after purchase) is slightly above 1k clients.

I think I have do done the installation by the book. Should I restart the servers every eg. 24h? Is it normal behavior?

Re: Nagios LS - Stops working after a few days

Posted: Mon Oct 14, 2019 12:29 pm
by benjaminsmith
Hello,

When it stops receiving logs, check the status of logstash?

Code: Select all

systemctl status logstash.service
Please PM your system profile for us to review. Go to Admin > System > System Status > Download System Profile. Thanks.

Re: Nagios LS - Stops working after a few days

Posted: Wed Oct 23, 2019 11:28 am
by benjaminsmith
Hello,

Thank you for sending over the profile. I'm seeing this error in the logs. By default, Logstash is not able to listen to ports below 1024.

Code: Select all

message=>"syslog listener died", :protocol=>:tcp, :address=>"0.0.0.0:514", :exception=>#<SocketError: initialize: name or service not known>, :backtrace=>["org/jruby/ext/socket/RubyTCPServer.java:126:in `initialize'"
An incorrect input/filter can cause logs to stop processing. To correct, please see the guide below.

Nagios Log Server Listening on Privileged Ports

Re: Nagios LS - Stops working after a few days

Posted: Mon Nov 18, 2019 6:24 am
by dariusz.nalazek
Log Server seems to work... w/o crashes after removing the listener below port 1000.

THXfor help.

Re: Nagios LS - Stops working after a few days

Posted: Mon Nov 18, 2019 7:18 am
by scottwilkerson
dariusz.nalazek wrote:Log Server seems to work... w/o crashes after removing the listener below port 1000.

THXfor help.
Great!

Locking thread