Graylog2 / Graylog2/graylog2-server

Alert in GUI when an input fails to start

Open
#5,305 0 comments 1 reaction 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior
[Please refer to this Graylog forum thread for some details. ](https://community.graylog.org/t/one-out-of-three-receiver-hosts-showed-0-connections/7741)

I run a multi-node Graylog cluster. I have run into a situation where one of my BEATS inputs was running, without any reported errors in the GUI. Two out of three nodes were receiving traffic, with the third node reporting 0 connections ever on its BEATS input. After perusing the server log file, it turned out that the input was having issues with its encryption keys.

I would appreciate it if such a situation would lead to an alert in the GUI.

## Current Behavior
At this point in time the Graylog GUI does not show a fault situation if a BEATS input has problems accepting traffic. The input has started, but cannot accept traffic. This is reported in the server log, but not in the GUI.

## Possible Solution
The alert could be shown in a similar way to other alerts that get shown in the red bar across the top of the GUI.

## Steps to Reproduce (for bugs)
1. Define a BEATS input with TLS security.
2. Provide a PEM key and CRT file.
3. Put the path to the CRT file in both the both for the certificate and for the private key (this is a mistake of course, but we're reproducing my fault).
4. The input will start, but won't accept input.

## Context
In our case this lead to an imbalance between our cluster nodes. The incoming messages went to two, instead of three receiving hosts.

## Your Environment
* Graylog Version: 2.4.6-1
* Elasticsearch Version: 5.6.2
* MongoDB Version: 4.0.2
* Operating System: CentOS 7.3
* Browser version: n.a.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.