Hi! Incomplete means that chunked gelf messages transported with UDP were not received properly. Gelf supports chunking larger messages into a series of UDP datagrams which then are reassembled after all parts have been received. This is to overcome the effective size limit of UDP datagrams but when your network has a tendency to lose UDP datagrams then this means you lose messages. In most scenarios you never notice but in the case of chunked gelf you do. The window in which the datagrams have to show up is 5 seconds I believe. Check the errors on your network devices to look for unexpected packet loss. If possible you might want to switch to gelf over TCP.
Best, Kay On Mar 24, 2014 5:43 PM, "Robert Blumen" <[email protected]> wrote: > Graylog2 is classifying 100% of incoming GELF messages as "incomplete". > > I tried to post this earlier but I believe that I failed. I apologize in > advance if this gets posted twice. > > Using: > > - mongod 2.4.9 > - elasticsearch 0.90.10 > - graylog server 0.20.1 > - graylog web 0.20.1 > - from java, me.moocar:logback-gelf:jar:0.10p2 > > Running a jetty web server on one node, sending GELF messages to GL at > 12202 on a different node. > > On GL I have a GELF UDP global input listening on 12202 > > - Under "show metrics" the counts of total messages and incomplete > messages in the input were showing all messages being classified as > incomplete. > - I upgraded the logging on the server node's Graylog2 subsystem to > "trace". The log showed a huge number of "Incomplete message" errors. > > The log messages were coming from GELFProcessor.java: > > > > > * 72 if (lm == null || !lm.isComplete()) { 73 > server.metrics().meter(name(metricName, "incompleteMessages")).mark(); > 74 LOG.debug("Skipping incomplete message."); > 75 return; 76 }* > > I need some help in determing why the messages are being classified as > incomplete. If the system provided a bit more information along those > lines that would be helpful. > > Robert > > -- > > > Robert Blumen > > [email protected] > > symphonycommerce.com > > > > 363 Clementina St. > > San Francisco, CA 94103 > > (415) 806-8389 > > -- > You received this message because you are subscribed to the Google Groups > "graylog2" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
