AppD Archive

Analytics UI not able to file my log file

CommunityUser
Splunk Employee
Splunk Employee

Hi team 

i have configured the job file in analytics agent of macine agent.i have also specified the source,gork pattern, and regex and set the flag enabled but still analytics UI is not able to reach my log file .

Can any one help?

0 Karma

Mohammed_Rayan
Contributor

Hi Amandeepthakur03,

Can you share the analytic agent & events-service logs to understand what's going on?

Regards,

Mohammed Rayan

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

thanks for reply mohammed.rayan

here are the log files

0 Karma

Mohammed_Rayan
Contributor

Hi amandeepthakur,

From the analytic agent logs,It's clear that the analytic agent is not up and running due to the presence of stale pid.

 Unable to create file [C:\quark\Softwares\Server(Standalone)1\machineagent\monitors\analytics-agent\analytics-agent.id] to store the process id because it already exists. Please stop any currently running process and delete the process id file

Can you please remove/delete the file analytics-agent.id from C:\quark\Softwares\Server(Standalone)1\machineagent\monitors\analytics-agent\ and then restart the analytic agent.

Then execute the healthcheck as given in the below doc

https://docs.appdynamics.com/display/PRO42/Troubleshooting#Troubleshooting-MonitoringHealthoftheAnal...

[2017-02-02T17:20:14,922+05:30]  [INFO ]  [main]  [c.a.c.framework.util.FrameworkHelper]  Application configuration version is [7], the YML file version is [7] and the properties file version is [7]
[2017-02-02T17:20:14,955+05:30]  [ERROR]  [main]  [c.a.common.framework.AbstractApp]  Severe error occurred while starting application [analytics-agent]. Shutdown procedure will commence soon
java.lang.RuntimeException: Unable to create file [C:\quark\Softwares\Server(Standalone)1\machineagent\monitors\analytics-agent\analytics-agent.id] to store the process id because it already exists. Please stop any currently running process and delete the process id file
	at com.appdynamics.common.framework.util.FrameworkHelper.createPidFile(FrameworkHelper.java:126)
	at com.appdynamics.common.framework.util.SimpleApp.beforeModuleLoading(SimpleApp.java:66)
	at com.appdynamics.analytics.agent.AnalyticsAgent$1.beforeModuleLoading(AnalyticsAgent.java:97)
	at com.appdynamics.analytics.agent.AnalyticsAgent$1.beforeModuleLoading(AnalyticsAgent.java:88)
	at com.appdynamics.common.framework.AbstractApp.run(AbstractApp.java:310)
	at com.appdynamics.common.framework.AbstractApp.run(AbstractApp.java:59)
	at io.dropwizard.cli.EnvironmentCommand.run(EnvironmentCommand.java:42)
	at io.dropwizard.cli.ConfiguredCommand.run(ConfiguredCommand.java:76)
	at io.dropwizard.cli.Cli.run(Cli.java:70)
	at io.dropwizard.Application.run(Application.java:72)
	at com.appdynamics.common.framework.AbstractApp.callRunServer(AbstractApp.java:267)
	at com.appdynamics.common.framework.AbstractApp.runUsingFile(AbstractApp.java:261)
	at com.appdynamics.common.framework.AbstractApp.runUsingTemplate(AbstractApp.java:248)
	at com.appdynamics.common.framework.AbstractApp.runUsingTemplate(AbstractApp.java:167)
	at com.appdynamics.common.framework.AbstractApp.runUsingTemplate(AbstractApp.java:146)
	at com.appdynamics.analytics.agent.AnalyticsAgent.main(AnalyticsAgent.java:100)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.lang.reflect.Method.invoke(Unknown Source)
	at com.appdynamics.common.executor.command.windows.AppRunServiceInternalCommand.execute(AppRunServiceInternalCommand.java:83)
	at com.appdynamics.common.executor.CommandExecutor.execute(CommandExecutor.java:38)
	at com.appdynamics.analytics.agent.executor.AnalyticsAgentExecutor.main(AnalyticsAgentExecutor.java:69)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.lang.reflect.Method.invoke(Unknown Source)
	at com.appdynamics.common.executor.standalone.ProxyMain.callActualMain(ProxyMain.java:158)
	at com.appdynamics.common.executor.standalone.ProxyMain.main(ProxyMain.java:106)

Regards,

Mohammed Rayan

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hi mohammed.rayan

thanks for the help that issue is resolved but now my log file is showing some thing else can you tell me what more i need to change

0 Karma

Mohammed_Rayan
Contributor

Hi,

It's complaining about the unauthorized error & incorrect grok pattern and can you upload your job file and the analytic agent properties file to check

[2017-02-03T12:01:11,183+05:30]  [ERROR]  [main]  [c.a.a.a.s.LogSourceConfigurationHelper]  Error occurred while retrieving extracted fields for sourceType [weblogic-admin-log].
[2017-02-03T12:01:11,184+05:30]  [ERROR]  [main]  [c.a.a.agent.source.LogSources]  Failed to load job file [C:\quark\Softwares\Server(Standalone)1\machineagent\monitors\analytics-agent\conf\job\sample-weblogic-log.job], skipping.
com.appdynamics.analytics.shared.rest.exceptions.UnauthorizedRestException: The supplied auth information is incorrect or not authorized.
	at com.appdynamics.analytics.shared.rest.exceptions.RestExceptionFactory.makeException(RestExceptionFactory.java:41) ~[analytics-shared-rest.jar:na]
	at com.appdynamics.analytics.shared.rest.client.utils.RestClientUtils.validateResponse(RestClientUtils.java:110) ~[analytics-shared-rest.jar:na]
	at com.appdynamics.analytics.shared.rest.client.utils.RestClientUtils.resolve(RestClientUtils.java:68) ~[analytics-shared-rest.jar:na]
	at com.appdynamics.analytics.shared.rest.client.utils.GenericHttpRequestBuilder.execute(GenericHttpRequestBuilder.java:183) ~[analytics-shared-rest.jar:na]
	at com.appdynamics.analytics.shared.rest.client.eventservice.DefaultExtractedFieldsClient.getExtractedFields(DefaultExtractedFieldsClient.java:136) ~[analytics-shared-rest.jar:na]
	at com.appdynamics.analytics.shared.rest.client.eventservice.DefaultExtractedFieldsClient.getExtractedFields(DefaultExtractedFieldsClient.java:119) ~[analytics-shared-rest.jar:na]
	at com.appdynamics.analytics.agent.field.ExtractedFieldsManager.getExtractedFieldPatterns(ExtractedFieldsManager.java:94) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.field.ExtractedFieldsManager.getExtractedFieldPatterns(ExtractedFieldsManager.java:77) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.source.LogSourceConfigurationHelper.getNonGrokPatterns(LogSourceConfigurationHelper.java:168) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.source.LogSourceConfigurationHelper.convertPipelineConfigurationToTailLogSourceConfiguration(LogSourceConfigurationHelper.java:90) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.source.LogSourceConfigurationHelper.convertPipelineConfigurationToLogSourceConfiguration(LogSourceConfigurationHelper.java:149) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.source.LogSources$1.visitFile(LogSources.java:299) [analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.source.LogSources$1.visitFile(LogSources.java:284) [analytics-agent.jar:na]
[2017-02-03T12:01:13,351+05:30]  [INFO ]  [file:poll:pipeline-poller-thread-0]  [c.a.a.agent.source.LogSources]  Skipped source [sample-jetty-error-log.job] because it is disabled.
[2017-02-03T12:01:13,468+05:30]  [INFO ]  [file:poll:pipeline-poller-thread-0]  [c.a.a.agent.source.LogSources]  Skipped source [sample-jetty-request-log.job] because it is disabled.
[2017-02-03T12:01:13,469+05:30]  [WARN ]  [file:poll:pipeline-poller-thread-0]  [c.a.a.a.p.d.LogSourceJobFileParser]  File [C:\quark\Softwares\Server(Standalone)1\machineagent\monitors\analytics-agent\conf\job\sample-log4j.job] could not be parsed as 'Job DSL' input to [log-pipeline.yml.template]. An attempt will be made to read it as a plain YML file
com.fasterxml.jackson.dataformat.yaml.snakeyaml.scanner.ScannerException: while scanning an alias; expected alphabetic or numeric character, but found but found .;  in 'reader', line 45, column 16:
        nameGlob: *.log
                   ^
	at com.fasterxml.jackson.dataformat.yaml.snakeyaml.scanner.ScannerImpl.scanAnchor(ScannerImpl.java:1439) ~[jackson-dataformat-yaml-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.dataformat.yaml.snakeyaml.scanner.ScannerImpl.fetchAlias(ScannerImpl.java:918) ~[jackson-dataformat-yaml-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.dataformat.yaml.snakeyaml.scanner.ScannerImpl.fetchMoreTokens(ScannerImpl.java:366) ~[jackson-dataformat-yaml-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.dataformat.yaml.snakeyaml.scanner.ScannerImpl.checkToken(ScannerImpl.java:226) ~[jackson-dataformat-yaml-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.dataformat.yaml.snakeyaml.parser.ParserImpl$ParseBlockMappingValue.produce(ParserImpl.java:586) ~[jackson-dataformat-yaml-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.dataformat.yaml.snakeyaml.parser.ParserImpl.peekEvent(ParserImpl.java:158) ~[jackson-dataformat-yaml-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.dataformat.yaml.snakeyaml.parser.ParserImpl.getEvent(ParserImpl.java:168) ~[jackson-dataformat-yaml-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.dataformat.yaml.YAMLParser.nextToken(YAMLParser.java:331) ~[jackson-dataformat-yaml-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.core.base.ParserMinimalBase.skipChildren(ParserMinimalBase.java:143) ~[jackson-core-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownProperty(BeanDeserializerBase.java:1289) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownVanilla(BeanDeserializerBase.java:1275) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:215) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.module.afterburner.deser.SuperSonicBeanDeserializer.deserializeFromObject(SuperSonicBeanDeserializer.java:233) ~[jackson-module-afterburner-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.module.afterburner.deser.SuperSonicBeanDeserializer.deserialize(SuperSonicBeanDeserializer.java:118) ~[jackson-module-afterburner-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:2993) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2052) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.appdynamics.analytics.agent.pipeline.dynamic.JobConfigurationDecoder.decodeStep1(JobConfigurationDecoder.java:62) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.pipeline.dynamic.JobConfigurationDecoder.toYml(JobConfigurationDecoder.java:45) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.pipeline.dynamic.LogSourceJobFileParser.parsePipelineConfigurationFromFile(LogSourceJobFileParser.java:65) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.pipeline.dynamic.LogSourceJobFileListener.upsert(LogSourceJobFileListener.java:74) [analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.pipeline.dynamic.LogSourceJobFileListener.onFileCreate(LogSourceJobFileListener.java:48) [analytics-agent.jar:na]
	at org.apache.commons.io.monitor.FileAlterationObserver.doCreate(FileAlterationObserver.java:379) [commons-io-2.4.jar:2.4]
	at org.apache.commons.io.monitor.FileAlterationObserver.checkAndNotify(FileAlterationObserver.java:345) [commons-io-2.4.jar:2.4]
	at org.apache.commons.io.monitor.FileAlterationObserver.checkAndNotify(FileAlterationObserver.java:304) [commons-io-2.4.jar:2.4]
	at org.apache.commons.io.monitor.FileAlterationMonitor.run(FileAlterationMonitor.java:182) [commons-io-2.4.jar:2.4]
	at java.lang.Thread.run(Unknown Source) [na:1.7.0_76]
[2017-02-03T12:01:13,472+05:30]  [ERROR]  [file:poll:pipeline-poller-thread-0]  [c.a.a.a.p.d.LogSourceJobFileListener]  Error occurred while processing file [C:\quark\Softwares\Server(Standalone)1\machineagent\monitors\analytics-agent\conf\job\sample-log4j.job]
com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "version" (class com.appdynamics.analytics.pipeline.framework.PipelineConfiguration), not marked as ignorable (3 known properties: "enabled", "id", "stages"])
 at [Source: java.io.StringReader@4b5d0cd; line: 7, column: 11] (through reference chain: com.appdynamics.analytics.pipeline.framework.PipelineConfiguration["version"])
	at com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException.from(UnrecognizedPropertyException.java:51) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.DeserializationContext.reportUnknownProperty(DeserializationContext.java:671) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.deser.std.StdDeserializer.handleUnknownProperty(StdDeserializer.java:773) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownProperty(BeanDeserializerBase.java:1297) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.deser.BeanDeserializerBase.handleUnknownVanilla(BeanDeserializerBase.java:1275) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:215) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.module.afterburner.deser.SuperSonicBeanDeserializer.deserializeFromObject(SuperSonicBeanDeserializer.java:204) ~[jackson-module-afterburner-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.module.afterburner.deser.SuperSonicBeanDeserializer.deserialize(SuperSonicBeanDeserializer.java:118) ~[jackson-module-afterburner-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:2993) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2098) ~[jackson-databind-2.3.4.jar:2.3.4]
	at com.appdynamics.analytics.agent.pipeline.dynamic.LogSourceJobFileParser.tryParsePipelineConfiguration(LogSourceJobFileParser.java:106) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.pipeline.dynamic.LogSourceJobFileParser.parsePipelineConfigurationFromFile(LogSourceJobFileParser.java:84) ~[analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.pipeline.dynamic.LogSourceJobFileListener.upsert(LogSourceJobFileListener.java:74) [analytics-agent.jar:na]
	at com.appdynamics.analytics.agent.pipeline.dynamic.LogSourceJobFileListener.onFileCreate(LogSourceJobFileListener.java:48) [analytics-agent.jar:na]
	at org.apache.commons.io.monitor.FileAlterationObserver.doCreate(FileAlterationObserver.java:379) [commons-io-2.4.jar:2.4]
	at org.apache.commons.io.monitor.FileAlterationObserver.checkAndNotify(FileAlterationObserver.java:345) [commons-io-2.4.jar:2.4]
	at org.apache.commons.io.monitor.FileAlterationObserver.checkAndNotify(FileAlterationObserver.java:304) [commons-io-2.4.jar:2.4]
	at org.apache.commons.io.monitor.FileAlterationMonitor.run(FileAlterationMonitor.java:182) [commons-io-2.4.jar:2.4]
	at java.lang.Thread.run(Unknown Source) [na:1.7.0_76]
0 Karma

CommunityUser
Splunk Employee
Splunk Employee

Hi mohammed.rayan

I am still not able to see my log file data in appdynamics. Please help me troubleshoot this problem.

0 Karma

Mohammed_Rayan
Contributor

Hi there,

The issue is with the path specified. According to our documentation the Windows log path should be provided as if it were a Unix environment and its documented here clearly

https://docs.appdynamics.com/display/PRO42/Configuring+Log+Analytics#ConfiguringLogAnalytics-MaptheL...

So the error below seems to be due to that and hence can you change the path to resemble like Unix path

[c.a.a.a.p.d.LogSourceJobFileListener]  Error occurred while processing file [C:\quark\Softwares\Server(Standalone)1\machineagent\monitors\analytics-agent\conf\job\sample-log4j.job]


com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException: Unrecognized field "version"

Chagne path: C:\quark\Softwares\Server(Standalone)1\log\  TO C:/quark/Softwares/Server(Standalone)1/log/

Also,comment out the below and verify further

#multiline:
#regex: "^\d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} - RequestURI =" 

0 Karma

CommunityUser
Splunk Employee
Splunk Employee

HI,

i have attached the Log4j.job file and my transaction log file.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...