Hi,
looks like your receiving some binary data on a plain text Gelf input. Did
you switch to TLS encryption or soemthing like that after the update? Could
you please post the generated configuration of NXlog?
Cheers,
Marius
On Wednesday, 22 June 2016 16:27:41 UTC+2, Shon Nixon wrote:
>
> Built a Graylog 2.0 cluster two weeks ago with three servers running 2.0.2
> behind a HAProxy server. Server accepts logs from all Windows boxes using
> Graylog Sidecar and Nxlog. Was working perfectly until I upgraded the
> server to 2.0.3 (yum upgrade). Restarted the services and now I get a
> constant flow of the log info below. Also can no longer access *System/Inputs
> -> Configurations* page. Just shows blank. I do have another two box
> cluster I built yesterday that started with 2.0.3 and has no issues at all
> getting data from the HAProxy box. I would rather not rebuild this cluster
> if possible...
>
>
> Reoccurring logging on all three boxes:
>
>
> 2016-06-22T10:15:13.732-04:00 ERROR [GelfCodec] Could not parse JSON,
> first 400 characters: ���vb� ����wxz�Tv��<�Q���u]?�I� �z��
> com.fasterxml.jackson.core.JsonParseException: Unexpected character ('�'
> (code 65533 / 0xfffd)): expected a valid value (number, String, array,
> object, 'true', 'false' or 'null')
> at [Source: ���vb� ����wxz�Tv��<�Q���u]?�I� �z��; line: 1, column: 2]
> at
> com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1581)
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:533)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.base.ParserMinimalBase._reportUnexpectedChar(ParserMinimalBase.java:462)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1624)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:689)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3771)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3716)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2272)
> ~[graylog.jar:?]
> at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:115)
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:136)
>
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:82)
>
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58)
>
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35)
>
> [graylog.jar:?]
> at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:139)
> [graylog.jar:?]
> at
> com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66)
>
> [graylog.jar:?]
> at java.lang.Thread.run(Thread.java:745) [?:1.8.0_73]
> 2016-06-22T10:15:13.732-04:00 ERROR [DecodingProcessor] Unable to decode
> raw message bc89d68a-3883-11e6-a89e-005056934db8 (journal offset 56420554)
> encoded as gelf received from /10.100.150.89:41076.
> 2016-06-22T10:15:13.732-04:00 ERROR [DecodingProcessor] Error processing
> message RawMessage{id=bc89d68a-3883-11e6-a89e-005056934db8,
> journalOffset=56420554, codec=gelf, payloadSize=41,
> timestamp=2016-06-22T14:15:13.640Z, remoteAddress=/10.100.150.89:41076}
> com.fasterxml.jackson.core.JsonParseException: Unexpected character ('�'
> (code 65533 / 0xfffd)): expected a valid value (number, String, array,
> object, 'true', 'false' or 'null')
> at [Source: ���vb� ����wxz�Tv��<�Q���u]?�I� �z��; line: 1, column: 2]
> at
> com.fasterxml.jackson.core.JsonParser._constructError(JsonParser.java:1581)
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.base.ParserMinimalBase._reportError(ParserMinimalBase.java:533)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.base.ParserMinimalBase._reportUnexpectedChar(ParserMinimalBase.java:462)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.json.ReaderBasedJsonParser._handleOddValue(ReaderBasedJsonParser.java:1624)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.core.json.ReaderBasedJsonParser.nextToken(ReaderBasedJsonParser.java:689)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper._initForReading(ObjectMapper.java:3771)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:3716)
>
> ~[graylog.jar:?]
> at
> com.fasterxml.jackson.databind.ObjectMapper.readTree(ObjectMapper.java:2272)
> ~[graylog.jar:?]
> at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:115)
> ~[graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:136)
>
> ~[graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:82)
>
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:58)
>
> [graylog.jar:?]
> at
> org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:35)
>
> [graylog.jar:?]
> at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:139)
> [graylog.jar:?]
> at
> com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66)
>
> [graylog.jar:?]
> at java.lang.Thread.run(Thread.java:745) [?:1.8.0_73]
>
--
You received this message because you are subscribed to the Google Groups
"Graylog Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to graylog2+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/graylog2/a0668e01-8444-48ec-9ad8-33c1489e9f6a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
