Graylog2 / Graylog2/graylog2-server

Include the host field in the error message in validateGELFMessage

Open
#9,545 0 comments 0 reactions 0 assignees View on GitHub
feature triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

If you have a kubernetes deployment of graylog it is not guaranteed that the remote address contains the real remote address, but the address of some kubernetes internal component, which makes it impossible to find out where the invalid message is coming from.

According to the code the "host" field is checked first for validity, so please add the host field contents to the prefix of the error messages for the following checks.
https://github.com/Graylog2/graylog2-server/blob/f35df42e165ac570b8b27de3f8eeac85e74ed610/graylog2-server/src/main/java/org/graylog2/inputs/codecs/GelfCodec.java#L237-L270

Most likely after line 248 something like
```
prefix += " (host: " + hostNode.asText() + ")"
```
would already suffice.

This would ease the situation of finding the faulty message sender.

Example log output where I face the struggles:

> 2020-11-18 15:58:36,999 ERROR [DecodingProcessor] - Error processing message RawMessage{id=eb18a665-29b6-11eb-846a-469d8a32127b, journalOffset=1283348, codec=gelf, payloadSize=263, timestamp=2020-11-18T15:58:36.998Z, remoteAddress=/10.42.14.0:44899} - {}
java.lang.IllegalArgumentException: GELF message (received from <10.42.14.0:44899>) has empty mandatory "short_message" field.
at org.graylog2.inputs.codecs.GelfCodec.validateGELFMessage(GelfCodec.java:258) ~[graylog.jar:?]
at org.graylog2.inputs.codecs.GelfCodec.decode(GelfCodec.java:140) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.processMessage(DecodingProcessor.java:150) ~[graylog.jar:?]
at org.graylog2.shared.buffers.processors.DecodingProcessor.onEvent(DecodingProcessor.java:91) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:90) [graylog.jar:?]
at org.graylog2.shared.buffers.processors.ProcessBufferProcessor.onEvent(ProcessBufferProcessor.java:47) [graylog.jar:?]
at com.lmax.disruptor.WorkProcessor.run(WorkProcessor.java:143) [graylog.jar:?]
at com.codahale.metrics.InstrumentedThreadFactory$InstrumentedRunnable.run(InstrumentedThreadFactory.java:66) [graylog.jar:?]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_265]

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.