Question:
My collector is not forwarding my log message to my Syslog receiver per the Data Forwarding rule applied to my Source. I have verified that the ports are open, unbound and netcat test messages are being sent from the host and received by the syslog server on the configured port and protocol.
I am seeing the following errors within the collectors collector.log file.
2017-09-12 16:31:22,371 +0000 [MTP-ResponseMessages-2] INFO com.sumologic.scala.collector.blade.Blade$ - Blade 410193841 has serviceType n/a, bladeType 4, isMetrics false, mapped to blade class LocalWildcardBlade
2017-09-12 16:31:22,369 +0000 [MTP-ResponseMessages-1] ERROR com.sumologic.scala.collector.ResponseMessageReceiver - Error consuming response message
java.io.IOException: Error while processing message 'configureSinks' with schema '{"type":"record","fields":[{"name":"configuration","type":{"type":"array","items":{"type":"record","name":"DataForwardSinkConfiguration","namespace":"com.sumologic.interchange.collector.v1","fields":[{"name":"sinkId","type":"long"},{"name":"sinkName","type":"string"},{"name":"configuration","type":"string"}]}}}]}'
at org.digitalresearch.avrox.messaging.AbstractConsumer.consume(AbstractConsumer.java:179)
at com.sumologic.scala.collector.ResponseMessageReceiver$$anon$2.run(ResponseMessageReceiver.scala:73)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.digitalresearch.avrox.messaging.SpecificConsumer.consume(SpecificConsumer.java:108)
at org.digitalresearch.avrox.messaging.AbstractConsumer.consume(AbstractConsumer.java:176)
... 4 more
Caused by: java.lang.NoClassDefFoundError: Could not initialize class org.productivity.java.syslog4j.Syslog
at com.sumologic.scala.collector.blade.forwarding.syslog.SyslogSender.createSender(SyslogForwardingPipeline.scala:83)
Or
Caused by: java.lang.UnsatisfiedLinkError: /tmp/jna1341630133398027706.tmp: /tmp/jna1341630133398027706.tmp: failed to map segment from shared object
at java.lang.ClassLoader$NativeLibrary.load(Native Method)
at java.lang.ClassLoader.loadLibrary0(ClassLoader.java:1941)
at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1824)
at java.lang.Runtime.load0(Runtime.java:809)
at java.lang.System.load(System.java:1086)
at com.sun.jna.Native.loadNativeLibraryFromJar(Native.java:775)
at com.sun.jna.Native.loadNativeLibrary(Native.java:699)
at com.sun.jna.Native.<clinit>(Native.java:114)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:264)
at org.productivity.java.syslog4j.util.SyslogUtility.isClassExists(SyslogUtility.java:127)
at org.productivity.java.syslog4j.Syslog.initialize(Syslog.java:177)
at org.productivity.java.syslog4j.Syslog.<clinit>(Syslog.java:44)
at com.sumologic.scala.collector.blade.forwarding.syslog.SyslogSender.createSender(SyslogForwardingPipeline.scala:83)
at com.sumologic.scala.collector.blade.forwarding.syslog.SyslogSender.<init>(SyslogForwardingPipeline.scala:54)
at com.sumologic.scala.collector.blade.forwarding.syslog.SyslogForwardingPipeline.<init>(SyslogForwardingPipeline.scala:26)
at com.sumologic.scala.collector.blade.LocalSinkPipelineDirectory$.createPipeline(LocalSinkPipelineDirectory.scala:14)
at com.sumologic.scala.collector.Collector$$anonfun$6.apply(Collector.scala:1007)
at com.sumologic.scala.collector.Collector$$anonfun$6.apply(Collector.scala:1007)
at com.sumologic.scala.collector.blade.forwarding.SinkPipelineDirectory$$anonfun$configure$2$$anonfun$1.apply(SinkPipelineDirectory.scala:26)
at com.sumologic.scala.collector.blade.forwarding.SinkPipelineDirectory$$anonfun$configure$2$$anonfun$1.apply(SinkPipelineDirectory.scala:24)
at scala.collection.mutable.MapLike$class.getOrElseUpdate(MapLike.scala:194)
at scala.collection.mutable.AbstractMap.getOrElseUpdate(Map.scala:80)
at com.sumologic.scala.collector.blade.forwarding.SinkPipelineDirectory$$anonfun$configure$2.apply(SinkPipelineDirectory.scala:24)
at com.sumologic.scala.collector.blade.forwarding.SinkPipelineDirectory$$anonfun$configure$2.apply(SinkPipelineDirectory.scala:22)
at scala.collection.immutable.Set$Set2.foreach(Set.scala:128)
at com.sumologic.scala.collector.blade.forwarding.SinkPipelineDirectory.configure(SinkPipelineDirectory.scala:22)
at com.sumologic.scala.collector.InboundCollectorProtocolHandler.configureSinks(InboundCollectorProtocolHandler.scala:87)
Answer:
The errors reported within the Collector logs file may be seen when the Collector is unable to execute from a /tmp directory on the host server. A class required by the data forwarding is unable to initialize thus causing the overall forwarding to fail. This may be caused by the /tmp mount being set with a "noexec" config. To confirm, you can check your/etc/fstab file and look for the "noexec" config applied to the /tmp mount. If /tmp is mounted noexec you will need to tell the Collector to use an alternate temp directory:
1.) Create a new directory on your host. This can be located within the Collector install path.
$collectorInstallDir/sumotmp
2.) Update your user.properties file add the line below. Location of the user.properties file will be in the SumoCollector directory in the config folder.
wrapper.java.additional.2=-Djava.io.tmpdir=C:\sumotmp
3.) Save the file
4.) Restart the Collector
Comments
0 comments
Please sign in to leave a comment.