This looks like a bug to me but what do you think?
It's the Graylog 1.3 Docker image, running with this command:
docker run -t \
--rm \
-p 9000:9000 \
-p 1514:1514/udp \
-p 12201:12201 \
-e GRAYLOG_TIMEZONE=EST5EDT \
-e GRAYLOG_RETENTION="--time=24 --indices=90" \
-e GRAYLOG_NODE_ID=redacted \
-e GRAYLOG_SERVER_SECRET=redacted \
-v /graylog/data:/var/opt/graylog/data \
-v /graylog/logs:/var/log/graylog \
graylog2/allinone
I'm using docker logs --follow to monitor it. About 7:30 last night the
message count in graylog went over 1000 per second with errors from
graylog-server and the log is constantly getting this error. After the
error is one of the messages from my server which I redacted:
2015-12-17_03:19:08.37179 Privileges: SeSecurityPrivilege |
ThreadID: 7072 | EventID: 4672 | _id: ef57cc81-a46c-11e5-85f7-0242ac110002
| RecordNumber: 39475793 | SubjectUserSid:
S-1-5-21-602162358-1284227242-1801674531-3790 }, messages=null}, sequence
211560
2015-12-17_03:19:08.37370 java.lang.IncompatibleClassChangeError: Class
java.lang.Class does not implement the requested interface
com.google.common.cache.LocalCache$ValueReference
2015-12-17_03:19:08.37478 at
com.google.common.cache.LocalCache$LoadingValueReference.get(LocalCache.java:3562)
2015-12-17_03:19:08.37605 at
com.google.common.cache.LocalCache$Segment.getLiveValue(LocalCache.java:2740)
2015-12-17_03:19:08.37920 at
com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2183)
2015-12-17_03:19:08.38246 at
com.google.common.cache.LocalCache.get(LocalCache.java:3937)
2015-12-17_03:19:08.38681 at
com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739)
2015-12-17_03:19:08.38848 at
org.graylog2.filters.ExtractorFilter.loadExtractors(ExtractorFilter.java:74)
2015-12-17_03:19:08.39095 at
org.graylog2.filters.ExtractorFilter.filter(ExtractorFilter.java:60)
2015-12-17_03:19:08.39215 at
org.graylog2.buffers.processors.ServerProcessBufferProcessor.handleMessage(ServerProcessBufferProcessor.java:97)
2015-12-17_03:19:08.39491 at
org.graylog2.shared.buffers.processors.ProcessBufferProcessor.dispatchMessage(ProcessBufferProcessor.java:82)
2015-12-17_03:19:08.39550 WARN [ProcessBuffer] Unable to process event
MessageEvent{raw=null, redacted
I'm still able to search however and things seem to otherwise be working.
Before I restart the container, any suggestions?
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/331bfab3-40c8-4b71-bbf4-f1487cd07925%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
