Graylog2 / Graylog2/graylog2-server
Include the host field in the error message in validateGELFMessage
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
If you have a kubernetes deployment of graylog it is not guaranteed that the remote address contains the real remote address, but the address of some kubernetes internal component, which makes it impossible to find out where the invalid message is coming from.
According to the code the "host" field is checked first for validity, so please add the host field contents to the prefix of the error messages for the following checks.
https://github.com/Graylog2/graylog2-server/blob/f35df42e165ac570b8b27de3f8eeac85e74ed610/graylog2-server/src/main/java/org/graylog2/inputs/codecs/GelfCodec.java#L237-L270
Most likely after line 248 something like
```
prefix += " (host: " + hostNode.asText() + ")"
```
would already suffice.
This would ease the situation of finding the faulty message sender.
Example log output where I face the struggles:
> 2020-11-18 15:58:36,999 ERROR [DecodingProcessor] - Error processing message RawMessage{id=eb18a665-29b6-11eb-846a-469d8a32127b, journalOffset=1283348, codec=gelf, payloadSize=263, timestamp=2020-11-18T15:58:36.998Z, remoteAddress=/10.42.14.0:44899} - {}
java.lang.IllegalArgumentException: GELF message (received from <10.42.14.0:44899>) has empty mandatory "short_message" field.
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:258) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:140) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:90) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:47) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_265]
Contributor guide
Assessment
This issue has not been assessed yet.