Gravwell Community Edition: A Splunk Alternative Built with Go

Re:Gravwell Community Edition: A Splunk Alternative Built wi... by Xorlev on Wednesday July 11, 2018 @10:48PM (#17511818)

I'll re-post my experience here:

I tried installing Gravwell from the Debian repo. This unfortunately seems broken.

  W: Failed to fetch http://update.gravwell.io/debian/dists/community/InRelease  Unable to find expected entry 'main/binary-i386/Packages' in Release file (Wrong sources.list entry or malformed file)

(also, that should probably be https://update.gravwell.io...)

Once installed from the tarball, it failed to start.

  The gravwell_webserver process is not running!

  If you kept an old configuration file the configuration parameters may have changed.  Try manually starting the services and looking for errors.

Sure, I need to go update the web ports to not interfere with nginx. Makes sense.

  $ vim /opt/gravwell/etc/gravwell.conf
  s/Web-Port=443/Web-Port=1443/
  $ systemd start gravwell_webserver
  $ systemd status gravwell_webserver
  gravwell_webserver.service - Gravwell Webserver Service
     Loaded: loaded (/etc/systemd/system/gravwell_webserver.service; enabled)
     Active: failed (Result: start-limit) since Thu 2018-07-12 02:15:07 UTC; 23min ago
    Process: 3411 ExecStart=/opt/gravwell/bin/gravwell_webserver -stderr %n (code=exited, status=255)

Huh, maybe I missed something else.

  $ journalctl -u gravwell_webserver
  -- Logs begin at Fri 2018-07-06 20:35:20 UTC, end at Thu 2018-07-12 02:41:26 UTC. --
  <EOF>

That's odd, where's the logs?

  $ ls -la /opt/gravwell/logs/web
  drwxr-x--- 2 gravwell gravwell 4096 Jul 12 02:07 .
  drwxr-x--- 4 gravwell gravwell 4096 Jul 12 02:17 ..

No logs. Lets check the crash folder?

  $ ls -la crash
  drwxr-x--- 2 gravwell gravwell 4096 Jul 12 02:17 .
  drwxr-x--- 4 gravwell gravwell 4096 Jul 12 02:17 ..
  -rw-r--r-- 1 root     root      322 Jul 12 02:07 gravwell_webserver.service_2018-07-12T02:07:36Z.log
  -rw-r--r-- 1 root     root      354 Jul 12 02:15 gravwell_webserver.service_2018-07-12T02:15:07Z.log

There it is. Double click the filename to copy to...oh, it has colons.

  $ less gravwell_webserver.service_2018-07-12T02\:15\:07Z.log

  Version         2.0
  API Version     0.1
  Build Date      2018-Jul-06
  Build ID        bcd7739a
  Cmdline         /opt/gravwell/bin/gravwell_webserver -stderr gravwell_webserver.service
  Executing user  gravwell
  Parent PID      3411
  Parent cmdline  /lib/systemd/systemd --system --deserialize 14
  Parent user     root
  Failed to wait for new license: listen tcp 0.0.0.0:80: bind: address already in use

Why's it listening on port 80? I must be missing a config option. Lets check the docs... https://dev.gravwell.io/docs/#!configuration/parameters.md

Nope. Not there. Nothing defaults to port 80 or looks like it would change it, except for Web-Port.

So, I really tried to give your product a shake. I'm very interested in having some centralized logging for my hobby projects, but not at the cost of nginx on port 80. So...\o/

[ Parent | on HN ]

Re:Gravwell Community Edition: A Splunk Alternative Built wi... by floren on Monday July 16, 2018 @04:25PM (#17544771)

We got a support email about this, if it was you then you probably already know the solution, but otherwise:

The port 80 listener is just a redirect to https. Add `Disable-HTTP-Redirector=true` to gravwell.conf to disable that redirector. The option is documented in the document you linked, but I can see how you'd miss it: we talk about "HTTP" and "HTTP" rather than "port 80" which would make it more of a pain to search for.

Changing `Web-Port` will change the HTTPS listener port, as you figured out.

We're working on populating our new knowledge base now with the answers to this and other questions which came up during our community edition rollout: http://help.gravwell.io/knowledge/

[ Parent | on HN ]