Can't find class; class_name='org/syslog_ng/SyslogNgClassLoader'

[OortJacek]

Hello,

there is problem when I am trying to use elasticsearch destination. The error occurs when "destination(d_elastic);" line is added.

There is installation configure: http://pastie.org/10331217

There is my config:

@Version: 3.7
@include "scl.conf"

@module mod-java

destination d_elastic {
java(
class_path("/opt/syslog-ng/lib/syslog-ng/java-modules/elastic.jar:/usr/share/elasticsearch/lib/*.jar")
class_name("org.syslog_ng.elasticsearch.ElasticSearchDestination")

option("index", "syslog-ng_${YEAR}.${MONTH}.${DAY}")
option("type", "test")

);
};

source s_local {
system();
internal();
};

destination d_local {
file("/var/log/jacekmessages");
};

log {
source(s_local);

    destination(d_local);
    destination(d_elastic);

};

There is the error:

jacek@uwbTestField:$ sudo syslog-ng
[2015-08-06T05:01:51.664423] Can't find class; class_name='org/syslog_ng/SyslogNgClassLoader'
**
ERROR:modules/java/native/java_machine.c:126:java_machine_get_class_loader: assertion failed: (self->loader)

[lbudai]

I think we have a fix for this on current master.
( the patch which should solve this issue: #615 )

[OortJacek]

I am afraid that I have this fix and it doesn't fix. Pulled from master one hour ago.

jacek@uwbTestField:~/syslog-ng-master/modules/java$ git log
commit 864eca7
Merge: 1f8a0fb 6447322
Author: Budai Laszlo laszlo.budai@balabit.com
Date: Wed Aug 5 19:36:03 2015 +0200

Merge pull request #607 from ccin2p3/faxmodem/systemd

Read configuration variables from sysconfig

commit 1f8a0fb
Merge: 558ded9 90e8deb
Author: Budai Laszlo laszlo.budai@balabit.com
Date: Wed Aug 5 19:34:19 2015 +0200

Merge pull request #615 from aneutrals/f/fix-libmod-java-linking

java: Fixed libjvm linking

commit 90e8deb
Author: Adam Arsenault aneutrals@users.noreply.github.com
Date: Tue Aug 4 16:19:01 2015 +0200

    java: Fixed libjvm linking

    Included the previously-unincluded JNI_LIBS flags for linking
    libmod-java to libjvm.so.

    Signed-off-by: Arsenault Adam <adam.arsenault@balabit.com>

[lbudai]

Do you have ElasticSearch jars in /usr/share/elasticsearch/lib/ ?
(If you have then could you attach a strace log?)

[OortJacek]

Yes, I have.

jacek@uwbTestField:~/syslog-ng-master$ ls /usr/share/elasticsearch/lib/
antlr-runtime-3.5.jar groovy-all-2.3.2.jar lucene-analyzers-common-4.10.3.jar lucene-highlighter-4.10.3.jar lucene-queries-4.10.3.jar lucene-suggest-4.10.3.jar
asm-4.1.jar jna-4.1.0.jar lucene-core-4.10.3.jar lucene-join-4.10.3.jar lucene-queryparser-4.10.3.jar sigar
asm-commons-4.1.jar jts-1.13.jar lucene-expressions-4.10.3.jar lucene-memory-4.10.3.jar lucene-sandbox-4.10.3.jar spatial4j-0.4.1.jar
elasticsearch-1.4.4.jar log4j-1.2.17.jar lucene-grouping-4.10.3.jar lucene-misc-4.10.3.jar lucene-spatial-4.10.3.jar

Here is strace:
https://gist.github.com/OortJacek/848d1d919fa303d75e40

[faxm0dem]

@OortJacek you also have to add /opt/syslog-ng/lib/syslog-ng/java-modules/*.jar to class_path

[OortJacek]

Didn't help.
Also adding: /usr/local/lib/syslog-ng/java-modules/*.jar" didn't help.

@Version: 3.7
@include "scl.conf"

@module mod-java

destination d_elastic {
java(
class_path("/opt/syslog-ng/lib/syslog-ng/java-modules/elastic.jar:/usr/share/elasticsearch/lib/.jar:/opt/syslog-ng/lib/syslog-ng/java-modules/.jar")
class_name("org.syslog_ng.elasticsearch.ElasticSearchDestination")

option("index", "syslog-ng_${YEAR}.${MONTH}.${DAY}")
option("type", "test")

);
};

source s_local {
system();
internal();
};

destination d_local {
file("/var/log/jacekmessages");
};

log {
source(s_local);

    destination(d_local);
    destination(d_elastic);

};

[faxm0dem]

could you check if the files syslog-ng-core.jar and syslog-ng-common.jar are in your class_path?

[OortJacek]

How can I do this?

[faxm0dem]

1. Find the two files in your filesystem
2. Make sure they're pointed to by your java(class_path("/path/to/the/two/jars")

[lbudai]

just list the directory (opt/syslog-ng/lib/syslog-ng/java-modules)

[OortJacek]

jacek@uwbTestField:~$ ls /opt
kibana nimsoft

But I have added /usr/local/lib/syslog-ng/java-modules/*.jar also.

jacek@uwbTestField:~$ ls /usr/local/lib/syslog-ng/java-modules/
activation-1.1.jar commons-digester-1.8.jar hadoop-common-2.7.1.jar jets3t-0.9.0.jar lucene-core-4.10.4.jar servlet-api-2.5.jar
antlr-runtime-3.5.jar commons-httpclient-3.1.jar hadoop-hdfs-2.7.1.jar jettison-1.1.jar lucene-grouping-4.10.4.jar slf4j-api-1.7.10.jar
apacheds-i18n-2.0.0-M15.jar commons-io-2.4.jar hamcrest-core-1.3.jar jetty-6.1.26.jar lucene-highlighter-4.10.4.jar slf4j-api-1.7.6.jar
apacheds-kerberos-codec-2.0.0-M15.jar commons-lang-2.6.jar hdfs.jar jetty-util-6.1.26.jar lucene-join-4.10.4.jar slf4j-log4j12-1.6.1.jar
api-asn1-api-1.0.0-M20.jar commons-logging-1.1.3.jar htrace-core-3.1.0-incubating.jar jline-0.9.94.jar lucene-memory-4.10.4.jar slf4j-log4j12-1.7.10.jar
api-util-1.0.0-M20.jar commons-math3-3.1.1.jar httpclient-4.2.5.jar jopt-simple-3.2.jar lucene-misc-4.10.4.jar snakeyaml-1.12.jar
asm-3.1.jar commons-net-3.1.jar httpcore-4.2.4.jar jsch-0.1.42.jar lucene-queries-4.10.4.jar snappy-java-1.0.4.1.jar
asm-4.1.jar curator-client-2.7.1.jar http.jar jsp-api-2.1.jar lucene-queryparser-4.10.4.jar snappy-java-1.1.1.6.jar
asm-commons-4.1.jar curator-framework-2.7.1.jar jackson-core-asl-1.9.13.jar jsr305-3.0.0.jar lucene-sandbox-4.10.4.jar spatial4j-0.4.1.jar
avro-1.7.4.jar curator-recipes-2.7.1.jar jackson-jaxrs-1.8.3.jar junit-3.8.1.jar lucene-spatial-4.10.4.jar stax-api-1.0-2.jar
commons-beanutils-1.7.0.jar dummy.jar jackson-mapper-asl-1.9.13.jar junit-4.12.jar lucene-suggest-4.10.4.jar syslog-ng-common.jar
commons-beanutils-core-1.8.0.jar elastic.jar jackson-xc-1.8.3.jar kafka_2.10-0.8.2.1.jar lz4-1.2.0.jar syslog-ng-core.jar
commons-cli-1.2.jar elasticsearch-1.6.0.jar java-xmlbuilder-0.4.jar kafka-clients-0.8.2.1.jar metrics-core-2.2.0.jar xercesImpl-2.9.1.jar
commons-codec-1.6.jar gradle-worker.jar jaxb-api-2.2.2.jar kafka.jar netty-3.7.0.Final.jar xml-apis-1.3.04.jar
commons-collections-3.2.1.jar gson-2.2.4.jar jaxb-impl-2.2.3-1.jar leveldbjni-all-1.8.jar netty-all-4.0.23.Final.jar xmlenc-0.52.jar
commons-compress-1.4.1.jar guava-16.0.1.jar jersey-core-1.9.jar log4j-1.2.16.jar paranamer-2.3.jar xz-1.0.jar
commons-configuration-1.6.jar hadoop-annotations-2.7.1.jar jersey-json-1.9.jar log4j-1.2.17.jar protobuf-java-2.5.0.jar zkclient-0.3.jar
commons-daemon-1.0.13.jar hadoop-auth-2.7.1.jar jersey-server-1.9.jar lucene-analyzers-common-4.10.4.jar scala-library-2.10.4.jar zookeeper-3.4.6.jar

[lbudai]

please, use the markdown formatting :-)

https://guides.github.com/features/mastering-markdown/

[faxm0dem]

also, at this point could you please pastebin the whole config (using markdown)

[OortJacek]

Ok, sorry. But I still cant paste this *jars to look good. :(

Here config:
http://pastebin.com/m5Jbf3pr

Here jars:
http://pastebin.com/Z7JCzdAT

Here my configure process:
http://pastebin.com/44AfWy1g

[lbudai]

hmm... your config is strange a little bit
In which directory did you install syslog-ng? I mean you set elastic.jar from /opt, but you also have a java-modules dir in another directory?

[OortJacek]

I have just run make install. Default location is in /usr/local/
I copy config from https://www.balabit.com/sites/default/files/documents/syslog-ng-ose-latest-guides/en/syslog-ng-ose-guide-admin/html/destination-elasticsearch-interaction.html

I modify my config: http://pastebin.com/wmsZz8p3 but still doesn't work.

[lbudai]

We found what caused this problem, I'm waiting for Travis, and, after that I'm going to merge it.

[lbudai]

@OortJacek :
This is closed by automatically when I merged the fix.
I think it fixed your issue, but I don't want to close it until you not checked it.

[OortJacek]

Ok, it is fixed.
Thanks.

[lbudai]

ok, then I'll close it.