Arch Linux User Repository

could you please add checksums for graylog-tmpfiles.conf and graylog.service?

I updated to latest version. When I try to start the service shows this message in "systemctl status graylog":

systemd[1]: graylog.service: Scheduled restart job, restart counter is at 1. systemd[1]: Stopped Graylog management server. systemd[1]: Started Graylog management server. java[921684]: WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance. systemd[1]: graylog.service: Scheduled restart job, restart counter is at 5. systemd[1]: Stopped Graylog management server. systemd[1]: graylog.service: Start request repeated too quickly. systemd[1]: graylog.service: Failed with result 'exit-code'. systemd[1]: Failed to start Graylog management server.

You could see below detailed information on journalctl with 5 attempt to start service:

03/02/2021 16:34 polkitd Operator of unix-session:2 successfully authenticated as unix-user:usuario to gain TEMPORARY authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.6959 [systemctl stop graylog] (owned by unix-user:usuario) 03/02/2021 16:34 polkit-kde-authentication-agent-1 Message of action: "Authentication is required to start 'graylog.service'." 03/02/2021 16:34 kernel audit: type=1130 audit(1612380861.827:93386): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 polkitd Operator of unix-session:2 successfully authenticated as unix-user:usuario to gain TEMPORARY authorization for action org.freedesktop.systemd1.manage-units for system-bus-name::1.6963 [systemctl start graylog] (owned by unix-user:usuario) 03/02/2021 16:34 systemd Started Graylog management server. 03/02/2021 16:34 java 2021-02-03 16:34:24,041 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:24,044 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:24,045 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:24,046 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:24,046 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:24,067 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.Main.main(Main.java:50) [server.jar:?] 03/02/2021 16:34 systemd graylog.service: Main process exited, code=exited, status=1/FAILURE 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 systemd graylog.service: Scheduled restart job, restart counter is at 1. 03/02/2021 16:34 systemd Stopped Graylog management server. 03/02/2021 16:34 systemd Started Graylog management server. 03/02/2021 16:34 java 2021-02-03 16:34:25,718 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:25,721 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:25,722 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:25,723 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:25,723 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:25,735 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.Main.main(Main.java:50) [server.jar:?] 03/02/2021 16:34 systemd graylog.service: Main process exited, code=exited, status=1/FAILURE 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 systemd graylog.service: Scheduled restart job, restart counter is at 2. 03/02/2021 16:34 systemd Stopped Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 systemd Started Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 java 2021-02-03 16:34:27,407 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:27,409 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:27,410 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:27,410 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:27,411 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] 03/02/2021 16:34 kernel audit: type=1131 audit(1612380867.430:93422): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 java 2021-02-03 16:34:27,422 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.Main.main(Main.java:50) [server.jar:?] 03/02/2021 16:34 systemd graylog.service: Main process exited, code=exited, status=1/FAILURE 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 systemd graylog.service: Scheduled restart job, restart counter is at 3. 03/02/2021 16:34 systemd Stopped Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 kernel audit: type=1130 audit(1612380867.647:93423): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 kernel audit: type=1131 audit(1612380867.647:93424): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 systemd Started Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 kernel audit: type=1130 audit(1612380867.650:93425): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 java 2021-02-03 16:34:29,056 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:29,058 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:29,059 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:29,060 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:29,060 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:29,071 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.Main.main(Main.java:50) [server.jar:?] 03/02/2021 16:34 systemd graylog.service: Main process exited, code=exited, status=1/FAILURE 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 systemd graylog.service: Scheduled restart job, restart counter is at 4. 03/02/2021 16:34 systemd Stopped Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 systemd Started Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 java 2021-02-03 16:34:30,782 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 4.0.2 [org.graylog.aws.AWSPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:30,785 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 4.0.2 [org.graylog.plugins.collector.CollectorPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:30,786 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 4.0.2 [org.graylog.plugins.threatintel.ThreatIntelPlugin] 03/02/2021 16:34 java 2021-02-03 16:34:30,786 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 6 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch6.Elasticsearch6Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:30,786 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elasticsearch 7 Support 4.0.2+1987d10 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin] 03/02/2021 16:34 java 2021-02-03 16:34:30,796 ERROR: org.graylog2.bootstrap.CmdLineTool - Invalid configuration 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:353) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:346) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:180) [server.jar:?] 03/02/2021 16:34 java at org.graylog2.bootstrap.Main.main(Main.java:50) [server.jar:?] 03/02/2021 16:34 systemd graylog.service: Main process exited, code=exited, status=1/FAILURE 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed' 03/02/2021 16:34 systemd graylog.service: Scheduled restart job, restart counter is at 5. 03/02/2021 16:34 systemd Stopped Graylog management server. 03/02/2021 16:34 systemd graylog.service: Start request repeated too quickly. 03/02/2021 16:34 systemd graylog.service: Failed with result 'exit-code'. 03/02/2021 16:34 systemd Failed to start Graylog management server. 03/02/2021 16:34 audit SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' 03/02/2021 16:34 audit SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=graylog comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

Thanks.

https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=graylog#n52

This line includes an extra = for the sed inplace replacement for message_journal_dir.

Which forms the configuration to be:

message_journal_dir = = /var/lib/graylog/data/journal

the plugin directory from the source .tgz should be included under /usr/lib/graylog/plugin

I would suggest using the following in the systemd service

ExecStart=/usr/bin/java -Djava.net.preferIPv6Addresses=true -Djava.library.path=/usr/lib/graylog/lib/sigar -Xms1g -Xmx1g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -jar /usr/lib/graylog/server.jar server -f /etc/graylog/server/server.conf -p /run/graylog/server.pid
StandardOutput=syslog
StandardError=syslog
SyslogIdentifier=graylog

and then users of this package can use syslog-ng to capture the graylog output to a specific file using filters in syslog-ng.conf.

As well, I found that running service as nobody doesn't work, but rather using root. I suppose a better way is to create a specific user/group for this service.