Graylog2-server: Applying bundle failes

Created on 16 Nov 2017  路  8Comments  路  Source: Graylog2/graylog2-server

Hi folks, observed probably a bug when applying a bundle. It's the shipped content 'Threat Intel Plugin' with Graylog2(.4 beta).

Steps to Reproduce

  1. Click on System / Content Packs
  2. Click in the menu on Content Packs
  3. Select content pack Graylog
  4. Select Threat Intel Plugin Shipped Content
  5. Click Apply content

Environment

  • Graylog Version: 2.4.0-beta.1+baf-09c7
  • Elasticsearch Version: 5.6.3
  • MongoDB Version: db version v3.2.11
  • Operating System: Debian GNU/Linux 9.2 (stretch)

Error

2017-11-16T14:22:04.523-05:00 ERROR [BundleImporter] Error while creating entities in content pack. Starting rollback.
com.mongodb.DuplicateKeyException: Write failed with error code 11000 and error message 'E11000 duplicate key error collection: graylog.lut_caches index: name_1 dup key: { : "whois-cache" }'
    at com.mongodb.operation.BaseWriteOperation.convertBulkWriteException(BaseWriteOperation.java:243) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation.access$300(BaseWriteOperation.java:60) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation$1.call(BaseWriteOperation.java:144) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation$1.call(BaseWriteOperation.java:133) ~[graylog.jar:?]
    at com.mongodb.operation.OperationHelper.withConnectionSource(OperationHelper.java:424) ~[graylog.jar:?]
    at com.mongodb.operation.OperationHelper.withConnection(OperationHelper.java:415) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation.execute(BaseWriteOperation.java:133) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation.execute(BaseWriteOperation.java:60) ~[graylog.jar:?]
    at com.mongodb.Mongo.execute(Mongo.java:819) ~[graylog.jar:?]
    at com.mongodb.Mongo$2.execute(Mongo.java:802) ~[graylog.jar:?]
    at com.mongodb.DBCollection.executeWriteOperation(DBCollection.java:340) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:335) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:326) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:296) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:262) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:184) ~[graylog.jar:?]
    at com.mongodb.DBCollection.save(DBCollection.java:405) ~[graylog.jar:?]
    at org.mongojack.JacksonDBCollection.save(JacksonDBCollection.java:1461) ~[graylog.jar:?]
    at org.mongojack.JacksonDBCollection.save(JacksonDBCollection.java:1442) ~[graylog.jar:?]
    at org.graylog2.lookup.db.DBCacheService.save(DBCacheService.java:70) ~[graylog.jar:?]
    at org.graylog2.bundles.BundleImporter.createLookupCaches(BundleImporter.java:722) ~[graylog.jar:?]
    at org.graylog2.bundles.BundleImporter.runImport(BundleImporter.java:191) [graylog.jar:?]
    at org.graylog2.bundles.BundleService.applyConfigurationBundle(BundleService.java:112) [graylog.jar:?]
    at org.graylog2.bundles.BundleService.applyConfigurationBundle(BundleService.java:105) [graylog.jar:?]
    at org.graylog2.rest.resources.system.bundles.BundleResource.applyBundle(BundleResource.java:184) [graylog.jar:?]
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_151]
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_151]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_151]
    at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_151]
    at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) [graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) [graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) [graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$VoidOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:143) [graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) [graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) [graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) [graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) [graylog.jar:?]
    at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]
    at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]
    at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]
    at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]
    at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]
    at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]
    at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
2017-11-16T14:22:04.531-05:00 ERROR [AnyExceptionClassMapper] Unhandled exception in REST resource
java.lang.RuntimeException: com.mongodb.DuplicateKeyException: Write failed with error code 11000 and error message 'E11000 duplicate key error collection: graylog.lut_caches index: name_1 dup key: { : "whois-cache" }'
    at org.graylog2.bundles.BundleImporter.runImport(BundleImporter.java:200) ~[graylog.jar:?]
    at org.graylog2.bundles.BundleService.applyConfigurationBundle(BundleService.java:112) ~[graylog.jar:?]
    at org.graylog2.bundles.BundleService.applyConfigurationBundle(BundleService.java:105) ~[graylog.jar:?]
    at org.graylog2.rest.resources.system.bundles.BundleResource.applyBundle(BundleResource.java:184) ~[graylog.jar:?]
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_151]
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_151]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_151]
    at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_151]
    at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory$1.invoke(ResourceMethodInvocationHandlerFactory.java:81) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:144) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:161) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$VoidOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:143) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:99) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:389) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:347) ~[graylog.jar:?]
    at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:102) ~[graylog.jar:?]
    at org.glassfish.jersey.server.ServerRuntime$2.run(ServerRuntime.java:326) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors$1.call(Errors.java:271) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors$1.call(Errors.java:267) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:315) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:297) [graylog.jar:?]
    at org.glassfish.jersey.internal.Errors.process(Errors.java:267) [graylog.jar:?]
    at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:317) [graylog.jar:?]
    at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:305) [graylog.jar:?]
    at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:1154) [graylog.jar:?]
    at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:384) [graylog.jar:?]
    at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:224) [graylog.jar:?]
    at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:176) [graylog.jar:?]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_151]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_151]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_151]
Caused by: com.mongodb.DuplicateKeyException: Write failed with error code 11000 and error message 'E11000 duplicate key error collection: graylog.lut_caches index: name_1 dup key: { : "whois-cache" }'
    at com.mongodb.operation.BaseWriteOperation.convertBulkWriteException(BaseWriteOperation.java:243) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation.access$300(BaseWriteOperation.java:60) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation$1.call(BaseWriteOperation.java:144) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation$1.call(BaseWriteOperation.java:133) ~[graylog.jar:?]
    at com.mongodb.operation.OperationHelper.withConnectionSource(OperationHelper.java:424) ~[graylog.jar:?]
    at com.mongodb.operation.OperationHelper.withConnection(OperationHelper.java:415) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation.execute(BaseWriteOperation.java:133) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation.execute(BaseWriteOperation.java:60) ~[graylog.jar:?]
    at com.mongodb.Mongo.execute(Mongo.java:819) ~[graylog.jar:?]
    at com.mongodb.Mongo$2.execute(Mongo.java:802) ~[graylog.jar:?]
    at com.mongodb.DBCollection.executeWriteOperation(DBCollection.java:340) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:335) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:326) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:296) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:262) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:184) ~[graylog.jar:?]
    at com.mongodb.DBCollection.save(DBCollection.java:405) ~[graylog.jar:?]
    at org.mongojack.JacksonDBCollection.save(JacksonDBCollection.java:1461) ~[graylog.jar:?]
    at org.mongojack.JacksonDBCollection.save(JacksonDBCollection.java:1442) ~[graylog.jar:?]
    at org.graylog2.lookup.db.DBCacheService.save(DBCacheService.java:70) ~[graylog.jar:?]
    at org.graylog2.bundles.BundleImporter.createLookupCaches(BundleImporter.java:722) ~[graylog.jar:?]
    at org.graylog2.bundles.BundleImporter.runImport(BundleImporter.java:191) ~[graylog.jar:?]
    ... 30 more
bug triaged
Source
picture iliaselmatani

Most helpful comment

I have just installed the latest 2.4.3 (not beta) and this bug is still present. Is there a fix I can apply or do I need the beta?

picture Dyehouse on 19 Apr 2018
👍2

All 8 comments

This is fixed in the latest 2.4 beta. Make sure to delete all existing threatintel lookup tables, caches and adapters and also remove the migration flags from the database so the contentpack will be applied again.

db.cluster_config.remove({type: "org.graylog.plugins.threatintel.migrations.V20170815111700_CreateThreatIntelLookupTables.MigrationCompleted"})
db.cluster_config.remove({type: "org.graylog.plugins.threatintel.migrations.V20170821100300_MigrateOTXAPIToken.MigrationCompleted"})
bernd picture bernd on 18 Dec 2017

I am getting this error on the latest version of graylog

donnydavis picture donnydavis on 30 Mar 2018

Same issue here. Fresh installation of 2.4.3

perbly picture perbly on 2 Apr 2018

I have just installed the latest 2.4.3 (not beta) and this bug is still present. Is there a fix I can apply or do I need the beta?

Dyehouse picture Dyehouse on 19 Apr 2018
👍2

I'm getting this same error on 2.4.5 (not beta)...removed 'all existing threatintel lookup tables, caches and adapters' as recommended above but still no dice. Was there any working solution to this?

lukestu picture lukestu on 9 Jun 2018

@lukestu Please post the complete error and warning messages from the logs of your Graylog node(s).

Did you upgrade your current Graylog cluster from previous versions or was it a completely new installation?

joschi picture joschi on 10 Jun 2018

Same here....
But using centos version.
I had seen this issue since 2.3 but never really looked at it

Created a content pack from one graylog-server and tried to apply to another server with same environment and versions.

CentOS Linux release 7.5.1804 (Core) 
3.10.0-862.3.3.el7.x86_64
elasticsearch-5.6.10-1.noarch
mongodb-org-3.2.20-1.el7.x86_64
graylog-server-2.4.5-1.noarch

Logs: https://pastebin.com/raw/uCWKhcGi

2018-06-21T16:05:14.240Z ERROR [BundleImporter] Error while creating entities in content pack. Starting rollback.
com.mongodb.DuplicateKeyException: Write failed with error code 11000 and error message 'E11000 duplicate key error collection: graylog2.lut_caches index: name_1 dup key: { : "otx-api-ip-cache" }'
    at com.mongodb.operation.BaseWriteOperation.convertBulkWriteException(BaseWriteOperation.java:243) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation.access$300(BaseWriteOperation.java:60) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation$1.call(BaseWriteOperation.java:144) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation$1.call(BaseWriteOperation.java:133) ~[graylog.jar:?]
    at com.mongodb.operation.OperationHelper.withConnectionSource(OperationHelper.java:424) ~[graylog.jar:?]
    at com.mongodb.operation.OperationHelper.withConnection(OperationHelper.java:415) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation.execute(BaseWriteOperation.java:133) ~[graylog.jar:?]
    at com.mongodb.operation.BaseWriteOperation.execute(BaseWriteOperation.java:60) ~[graylog.jar:?]
    at com.mongodb.Mongo.execute(Mongo.java:819) ~[graylog.jar:?]
    at com.mongodb.Mongo$2.execute(Mongo.java:802) ~[graylog.jar:?]
    at com.mongodb.DBCollection.executeWriteOperation(DBCollection.java:340) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:335) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:326) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:296) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:262) ~[graylog.jar:?]
    at com.mongodb.DBCollection.insert(DBCollection.java:184) ~[graylog.jar:?]
    at com.mongodb.DBCollection.save(DBCollection.java:405) ~[graylog.jar:?]
    at org.mongojack.JacksonDBCollection.save(JacksonDBCollection.java:1461) ~[graylog.jar:?]
    at org.mongojack.JacksonDBCollection.save(JacksonDBCollection.java:1442) ~[graylog.jar:?]
    at org.graylog2.lookup.db.DBCacheService.save(DBCacheService.java:70) ~[graylog.jar:?]
    at org.graylog2.bundles.BundleImporter.createLookupCaches(BundleImporter.java:722) ~[graylog.jar:?]
    at org.graylog2.bundles.BundleImporter.runImport(BundleImporter.java:191) [graylog.jar:?]
    at org.graylog2.bundles.BundleService.applyConfigurationBundle(BundleService.java:112) [graylog.jar:?]

Willing to test

davama picture davama on 21 Jun 2018

this is still broken. the problem persists in the latest version of graylog. tested on debian 8.

fixed with:

db.lut_tables.drop()
db.lut_data_adapters.drop()
db.lut_caches.drop()

unbaiat picture unbaiat on 29 Jul 2018
Was this page helpful?
0 / 5 - 0 ratings

Related issues

ianling picture ianling  路  4Comments
1tft picture 1tft  路  3Comments
mikkolehtisalo picture mikkolehtisalo  路  4Comments
jalogisch picture jalogisch  路  3Comments
jozefbarcin picture jozefbarcin  路  3Comments