Alert triggered but message not included

[123dev]

Problem description

We use graylog-jira-alarmcallback to log jira tickets when an alert on a stream is raised.

Every now and then we notice that an alert is raised without the message being passed to the plugin.
We have configured the alert condition as such.
More than 0 messages in the last 1 minute and wait at least 0 minutes until triggering a new alert.
When sending an alert, include the last 1 messages ...

Checking the graylog logs around the problem time we see the following message.

2016-06-17_16:52:04.15041 2016-06-17 16:52:04,149 WARN : com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback - Skipping JIRA-issue MD5 generation, alarmcallback did not provide a message

We initailly logged an issue with the plugin author who after investigating the issue believed this is possibly a graylog bug.
You can see the discussion here

It is worth to note that we are running more than one graylog servers in a clustered environment, in case that has any relevance.

Steps to reproduce the problem

Not easy, as it happens rarely

• Setup and configure the graylog-jira-alarmcallback
• Monitor the graylog logs for a message similar to this.
  WARN : com.bidorbuy.graylog.alarmcallbacks.jira.JiraAlarmCallback - Skipping JIRA-issue MD5 generation, alarmcallback did not provide a message

Environment

AWS Image

• Graylog Version: 2.0.2 (but happens with 1.3.x as well)

Thanks

[kroepke]

This looks to be a problem with the message count alert condition code. It first retrieves the number of matching messages and then runs a second query to retrieve the actual messages.

For the second query it uses a RelativeRange time range object, which unfortunately reevaluates its boundaries again. The code should really be using an AbsoluteRange with the original boundaries or simply run the query without doing a count first.

All other alert conditions behave correctly.

[123dev]

Thanks for the update Kay.

[bernd]

A fix for this will be included in the upcoming Graylog 2.1. #2546

[123dev]

Can this be reopened, or should a new ticket be logged.
The problem is not resolved.

I setup multiple notification plugins (Jira, slack)
and when this problem arises (of course not all the time) then all plugins don't receive the last message.
That confirms that the issue is with Graylog and not the plugin.

Thanks

[bernd]

@123dev Please open a new issue and add details on how to reproduce this. Thank you!