I used a standalone test box to get my REST collector working like I wanted. authentication, discover and collect worked great. When I moved it into my distributed environment, it errors out but does pull in some events. The discovery and collect phases are distrubuted across my 5 workers. It seems like the authentication token may not be working properly when it runs on more than one worker? I am guessing of course. I get errors like 503 Service Temporaily Unavailable and 500 Internal Server Error. This does not happen when I run it from my single standalone test server. I may need some assistance trying to figure this one out.
Page 1 / 1
since this question was posted, we’ve introduced Retries to the REST collector (4.3) - this might be a way around it such that when the API returns a 500, the worker can retry after a certain amount of time with a backoff. might be worth a shot, https://docs.cribl.io/stream/collectors-rest/#retries
@seancannon what other context or logs can you provide if you haven’t figured this out
Reply
Login to the community
No account yet? Create an account
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.