Relay troubleshooting tips (v1.4.2)

The Devo In-house Relay software is based on a Syslog engine called Scoja written in Java. Also, there are some processes written in Python that perform other tasks.

Once running, the Scoja process listens for TCP/UDP connections on ports and, depending on the port, it modifies the Syslog events and forwards them to the Devo central collector. The main role of the relay is to tag events based on a defined rule, then forward the tagged events to Devo. 

The relay comes with a few ports that are preconfigured with rules for managing specific types of events. For example, port 13000 is preconfigured to forward the events received directly to Devo without any other processing. This port should be used for events that are properly tagged in the data source. You can also create custom rules to tag and/or filter the events sent to the associated port on the relay. Each rule is stored in one of these two folders:

• /opt/devo/scoja-server/conf/rules/ → Rules managed from the Devo web application.
• /opt/devo/scoja-server/conf/unrules/ → Rules not managed from the Devo web application. These rules are directly managed from the relay machine itself.

About the relay logs files

First, a word about the logs generated by the Devo Relay that can be used to investigate and identify problems with the relay.

The main logs files are:

• /var/log/scoja.log → Main activity log of the Scoja engine. For example, if there is an error starting the process, it will be logged in this file.
• /var/log/lt-relay.log → Contains events related to rules and changes to the relay configuration.

In addition, daily log files are generated and stored in:

/var/logt/local/<year>/<month>/<day>/<relayName>/syslog/scoja/

• main.log → main process log file
• source.log → logs related to the sources configured
• thread.log → threads opened for each source
• stats.log → statistics about received and sent events
• target.log  → logs related to the sending process

These five daily logs are compressed at night by a cron task.

Troubleshooting checklist

Make sure only one Scoja process (Java) is running 

# ps auxwww|grep java|grep scoja|grep -v grep
root     20312  0.9 14.1 5656324 2260448 ?     Sl   Oct05  56:23 java -Xms2G -Xmx2G -XX:+UseConcMarkSweepGC -classpath /opt/devo/scoja-server/lib/scoja-server-1.4.0.jar:/opt/devo/scoja-server/lib/scoja-client-1.4.0.jar:/opt/devo/scoja-server/lib/scoja-beep-1.4.0.jar:/opt/devo/scoja-server/lib/scoja-rpc-1.4.0.jar:/opt/devo/scoja-server/lib/scoja-compression-1.4.0.jar:/opt/devo/scoja-server/lib/scoja-rpc-xc-1.4.0.jar:/opt/devo/scoja-server/lib/scoja-cc-1.4.0.jar:/opt/devo/scoja-server/lib/jython-standalone-2.7.2b3.jar:/opt/devo/scoja-server/lib/log4j-1.2.17.jar org.scoja.server.Scoja -r 5s -G /opt/devo/scoja-server/conf/all-me.conf -j /opt/devo/scoja-server/conf/all-var.conf

If there is more than one process running, you should kill all of them using the command kill -9 <PID>, then start the relay again:

sudo /etc/init.d/devo-scoja-relay start

If the Java process is still not appearing after restarting the relay, check the scoja.log file for errors.

Check the scoja.log file for errors

Use cat to display the contents of the scoja.log:

# cat /var/log/scoja.log
Oct  5 13:12:09 relay-awsus-testing syslog.scoja.configuration: (Re)Loading configuration file /opt/devo/scoja-server/conf/all-me.conf
Oct  5 13:12:09 relay-awsus-testing syslog.scoja.thread: Starting thread 1 for Queue "internal queue" with 1 queued events, 1 max threads, 1 threads started, 0 threads awaiting
Oct  5 13:12:09 relay-awsus-testing syslog.scoja.configuration: (Re)Loading configuration file /opt/devo/scoja-server/conf/parameters.conf
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.configuration: Configuration file /opt/devo/scoja-server/conf/parameters.conf successfully parsed
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.configuration: Configuration file /opt/devo/scoja-server/conf/parameters.conf successfully (re)loaded
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.configuration: (Re)Loading configuration file /opt/devo/scoja-server/conf/me.conf
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.configuration: Configuration file /opt/devo/scoja-server/conf/me.conf successfully parsed
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.configuration: Configuration file /opt/devo/scoja-server/conf/me.conf successfully (re)loaded
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.configuration: Configuration file /opt/devo/scoja-server/conf/all-me.conf successfully (re)loaded
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.configuration: (Re)Loading configuration file /opt/devo/scoja-server/conf/all-var.conf
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.configuration: Configuration file /opt/devo/scoja-server/conf/all-var.conf successfully parsed
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.configuration: Configuration file /opt/devo/scoja-server/conf/all-var.conf successfully (re)loaded
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.source.measurer: Starting Measurer source
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.thread: Starting thread 1 for Measurer source
...
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.thread: Starting thread 1 for UDP source listening at 0.0.0.0:13000
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.thread: Starting thread 2 for UDP source listening at 0.0.0.0:13000
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.source.net.tcp: Starting Selecting TCP source listening at 0.0.0.0:13000
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.source.net.udp: Opening server socket for UDP source listening at 0.0.0.0:13000
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.thread: Starting thread 1 for Selecting TCP source listening at 0.0.0.0:13000
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.thread: Starting thread 2 for Selecting TCP source listening at 0.0.0.0:13000
...
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.main: Reloader started to run every 5.0 seconds
Oct  5 13:12:11 relay-awsus-testing syslog.scoja.main: Scoja started

If the log file contains the error /opt/logtrust/scoja/scoja.sh: 60: java: not found, this means that it is unable to find the Java interpreter. In this case, consider creating a symbolic link or editing the JAVA_HOME environment variable.

Confirm that the default ports are listening

• Ports 13000-13002 are listening on both TCP and UDP.
• Port 12999 is listening on UDP and is prepared to receive external Netflow traffic (Netflow version < 9). 
• Port 5141 is for internal Netflow traffic obtained using fprobe.
• Port 5140 is listening on TCP and UDP to handle internal relay logs. 

# netstat -atunp | grep java | grep -v ESTABLISHED
tcp6       0      0 :::13000                :::*                    LISTEN      887/java
tcp6       0      0 :::13001                :::*                    LISTEN      887/java
tcp6       0      0 :::13002                :::*                    LISTEN      887/java
tcp6       0      0 127.0.0.1:5140          :::*                    LISTEN      887/java
udp6       0      0 :::12999                :::*                                887/java
udp6       0      0 :::13000                :::*                                887/java
udp6       0      0 :::13001                :::*                                887/java
udp6       0      0 :::13002                :::*                                887/java
udp6       0      0 127.0.0.1:5140          :::*                                887/java
udp6       0      0 127.0.0.1:5141          :::*                                887/java

Ensure that the client certificate is installed

The client certificate file, client.jks, should be installed in the relay's /opt/devo/scoja-server/conf/keys/ folder. 

# ls -al /opt/devo/scoja-server/conf/keys
total 16
drwx------ 2 root root 4096 Jan 28 10:24 .
drwxr-xr-x 5 root root 4096 Jan 28 10:24 ..
-rw-r--r-- 1 root root 8048 Jan 28 10:24 client.jks

If the certificate download fails, you can force the download again:

1. Log into the Devo web application.
2. Go to Administration → Relays and select the name of the relay in the list. The Rules screen appears. 
3. Select the Force Generate New Certificate checkbox, then click the Apply Configuration button.

Ensure that the relay configuration is updating correctly

A cron task runs every minute to check if any changes to the relay configuration have been made in Devo. The result of this check appears in the lt-relay.log file. 

# cat /var/log/lt-relay.log:
2016-01-28 10:16:01.374445 [ERROR] Property 'api.key' not found in conf file
2016-01-28 10:17:01.510618 [ERROR] Property 'api.key' not found in conf file
2016-01-28 10:18:01.651220 [ERROR] Property 'api.key' not found in conf file
2016-01-28 10:19:01.791669 [ERROR] Property 'api.key' not found in conf file
2016-01-28 10:20:01.932002 [ERROR] Property 'api.key' not found in conf file
2016-01-28 10:21:02.073736 [ERROR] Property 'api.key' not found in conf file
2016-01-28 10:22:01.208316 [ERROR] Property 'api.key' not found in conf file
2016-01-28 10:23:00.488298 [SUCCESS] Relay activation is still pending, waiting for user to activate the Relay
2016-01-28 10:23:01.158783 [SUCCESS] Relay activation is still pending, waiting for user to activate the Relay
2016-01-28 10:24:01.331976 [SUCCESS] Relay is active, deploying new configuration set
2016-01-28 10:25:01.794021 [SUCCESS] No changes in the Relay Configuration
2016-01-28 10:26:01.975251 [SUCCESS] No changes in the Relay Configuration
...

• The "Property 'api.key' not found in conf file" message indicates that the devo-relay-configure process has not been executed yet and there is no API key defined in the relay.
• The "Relay activation is still pending" message indicates that the relay is registered but has not yet been activated in the Devo web application.
• The "Relay is active" message confirms that the relay has been activated and new configuration has been downloaded.

Once activated, you will be able to define the relay rules using the web application. The relay will begin checking the configuration for updates every 1 minute.

• The "No changes in Relay Configuration" message occurs every minute to confirm that no changes were detected in the relay configuration.

During the first configuration, the certificate is also downloaded. If the certificate download fails, you must force the download again.

Send test events to confirm relay is receiving and forwarding correctly

We can use netcat to send 100 events to the relay port 13000' to confirm that it is receiving and forwarding events to Devo. Enter this command on the relay machine:

for i in `seq 1 100`; do (echo "<14>Jan  1 00:00:00 xxx test.keep.free: test event $i"|nc -w0 localhost 13000); done

To confirm that the events were processed correctly, open Devo, go to Data Search, and locate the test.keep.free table. This table should contain 100 events. 

If there are no events logged in the test.keep.free table, check the unknown.unknown table. If there was a problem applying the tags, events will be logged in this table.

Check if the firewall is disabled 

CentOS 7

# systemctl status firewalld 
● firewalld.service - firewalld - dynamic firewall daemon 
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) 
   Active: inactive (dead) 
     Docs: man:firewalld(1) 
[vagrant@localhost ~]$ systemctl disable firewalld 


# systemctl disable firewalld

Check the relay's internet proxy configuration

If the Devo relay uses a proxy to access the Internet, you can review the configuration for possible errors.

The internet proxy is configured in /opt/devo/scoja-server/conf/local.py. In the sample configuration below, the proxy IP address is 12.12.12.12 and the port is 8080.

... 
# LogTrust collectors 
nextHops = [ 
#hop(host,port[,proxy,proxyPort]) 
hop(host="eu.elb.relay.logtrust.net", port=443, proxy="12.12.12.12", proxyPort=8080), 
] 
...

The hop host should be the hostname for the Devo region you are using and the port must always be 443. These are the hostnames by region.

• Europe: eu.elb.relay.logtrust.net
• USA: us.elb.relay.logtrust.net
• Spain: es.elb.relay.logtrust.net

Some common problems and solutions

Problem 1

Scoja (java process) Out of Memory

Solution: In case the issue is related to the memory buffer there are two possible solutions: increase allocated memory for scoja or decrease memory buffer size (it can be done from the web).

In order to increase allocated memory, check Managing the relay on the command line (v1.4.2). Once updated,  restart the relay.