<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">On Tue, Jan 26, 2016 at 10:57 PM Joel Serrano <<a href="mailto:joel@gogii.net">joel@gogii.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi, <div><br></div><div>I'm using collectd's tail plugin to read from a logfile and send metrics to influxdb via write_graphite plugin. </div><div><br></div><div>The strange thing is that when there are no new events in the logfile, collectd still send metrics with "nan" value, every 20 seconds.<br></div><div><br></div><div>This makes influxdb complain:</div><div><br></div><div>[graphite] 2016/01/26 19:43:47 unable to parse line: stats.server.13cn37.tail.fs.gauge.metric1 nan 1453866221: field "stats.server.13cn37.tail.fs.gauge.metric1" value: 'NaN" is unsupported<br></div><div><br></div><div><br></div><div>My settings are very very simple:</div><div><br></div><div>1) collectd.conf: Load tail and write_graphite plugins.</div><div><br></div><div><br></div><div>2) The config for the write_graphite plugin:</div><div><font face="monospace, monospace"><br></font></div><div><div><font face="monospace, monospace"><Plugin "write_graphite"></font></div><div><font face="monospace, monospace"> <Node "cpd1"></font></div><div><font face="monospace, monospace"> Host "<a href="http://graphite.example.com" target="_blank">graphite.example.com</a></font></div><div><font face="monospace, monospace"> Port "2003"</font></div><div><font face="monospace, monospace"> Prefix "stats.server."</font></div><div><font face="monospace, monospace"> #Postfix ""</font></div><div><font face="monospace, monospace"> Protocol "tcp"</font></div><div><font face="monospace, monospace"> LogSendErrors true</font></div><div><font face="monospace, monospace"> EscapeCharacter "."</font></div><div><font face="monospace, monospace"> SeparateInstances true</font></div><div><font face="monospace, monospace"> StoreRates false</font></div><div><font face="monospace, monospace"> AlwaysAppendDS false</font></div><div><font face="monospace, monospace"> </Node></font></div><div><font face="monospace, monospace"></Plugin></font></div></div><div><br></div><div><br></div><div>3) The config for the tail plugin:</div><div><br></div><div><div><font face="monospace, monospace"><Plugin "tail"></font></div><div><font face="monospace, monospace"> <File "/usr/local/app/log/application.log"></font></div><div><font face="monospace, monospace"> Instance "fs"</font></div><div><font face="monospace, monospace"> <Match></font></div><div><font face="monospace, monospace"> Regex "^.*metric_name: metric1, metric_value: (.*)$"</font></div><div><font face="monospace, monospace"> DSType "GaugeLast"</font></div><div><font face="monospace, monospace"> Type "gauge"</font></div><div><font face="monospace, monospace"> Instance "</font><span style="font-family:monospace,monospace">metric1</span><font face="monospace, monospace">"</font></div><div><font face="monospace, monospace"> </Match></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> <Match></font></div><div><font face="monospace, monospace"> Regex "^.*metric_name: </font><span style="font-family:monospace,monospace">metric2</span><font face="monospace, monospace">, metric_value: (.*)$"</font></div><div><font face="monospace, monospace"> DSType "GaugeLast"</font></div><div><font face="monospace, monospace"> Type "gauge"</font></div><div><font face="monospace, monospace"> Instance "</font><span style="font-family:monospace,monospace">metric2</span><font face="monospace, monospace">"</font></div><div><font face="monospace, monospace"> </Match></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> <Match></font></div><div><font face="monospace, monospace"> Regex "^.*metric_name: </font><span style="font-family:monospace,monospace">metric3</span><font face="monospace, monospace">, metric_value: (.*)$"</font></div><div><font face="monospace, monospace"> DSType "GaugeLast"</font></div><div><font face="monospace, monospace"> Type "gauge"</font></div><div><font face="monospace, monospace"> Instance "</font><span style="font-family:monospace,monospace">metric3</span><font face="monospace, monospace">"</font></div><div><font face="monospace, monospace"> </Match></font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace"> <Match></font></div><div><font face="monospace, monospace"> Regex "^.*metric_name: </font><span style="font-family:monospace,monospace">metric4</span><font face="monospace, monospace">, metric_value: (.*)$"</font></div><div><font face="monospace, monospace"> DSType "GaugeLast"</font></div><div><font face="monospace, monospace"> Type "gauge"</font></div><div><font face="monospace, monospace"> Instance "</font><span style="font-family:monospace,monospace">metric4</span><font face="monospace, monospace">"</font></div><div><font face="monospace, monospace"> </Match></font></div><div><span style="font-family:monospace,monospace"> </span><br></div><div><font face="monospace, monospace"> </File></font></div><div><font face="monospace, monospace"></Plugin></font></div></div><div><br></div><div><br></div><div><br></div><div>If there are new events in the logfile and the regex match, the values are sent correctly, if the values don't match or there are no new events, then they are all sent with "nan".</div><div><br></div><div>Any idea what can be happening?<br></div><div><br></div><div>InfluxDB: v0.9.5</div><div>collectd: v5.4.1</div></div></blockquote><div><br></div><div>I don't get this error. Which log file are you seeing this error? I am using collectd 5.5.0 and influxdb 0.9.6.1. Perhaps you need an upgrade to one or both. You may want to peruse the changelogs to see this was a known problem that has since been fixed.<br><br></div><div>I have a minimal config in collectd to match yours:<br><br>LoadPlugin tail <br><Plugin tail><br> <File "/var/log/secure"><br> Instance "secure"<br> <Match> <br> Regex "\\<sshd[^:]*: Invalid user [^ ]+ from\\>"<br> DSType "CounterInc"<br> Type "counter"<br> Instance "sshd-invalid_user"<br> </Match><br> </File><br></Plugin><br><br></div><div>This was an example from the wiki: <a href="https://collectd.org/wiki/index.php/Plugin:Tail#Invalid_SSH_login_attempts">https://collectd.org/wiki/index.php/Plugin:Tail#Invalid_SSH_login_attempts</a> <br><br></div><div>This is a log file on a private VM that is not getting any active or failed sshd attempts, so each tail interval should return zero. I don't see any errors in collectd.log or influxd.log.<br><br></div><div>Here is the output I get from influxdb:<br>> select * from "stats.server.localhost.tail.secure.counter.sshd-invalid_user"
<br>name: stats.server.localhost.tail.secure.counter.sshd-invalid_user ------------------------------------------------------------------
<br>time value
<br>1454180922000000000 0<br>1454180932000000000 0<br>1454180942000000000 0<br>1454180952000000000 0<br>1454180962000000000 0
<br>...<br><br></div><div>No NaN's, just zeroes.<br><br></div><div>Hope that helps.<br><br></div><div>Giovanni<br></div></div></div>