Is liagentd supposed to run on the vRLI server itself?

[Joffer]

I've got vRLI v4.5.1 installed and I see that the agent is set to run automatically on the server itself:

# chkconfig --list liagentd
liagentd                  0:off  1:off  2:off  3:on   4:off  5:on   6:off

Is it suppsed to? It seems to not be configured properly:

Cannot find section for [server].hostname in config. Using default: loginsight
Transport error while trying to connect to 'loginsight': Couldn't resolve host name

A full logoutput-snip:

# cat /var/log/loginsight-agent/liagent_2017-11-30_00.log
2017-11-30 13:07:27.700617 0x00007f0d094e9700 <warng> AgentDaemon:433    | Cannot find any section <server> in the configuration. The default will be configured.
2017-11-30 13:07:27.700756 0x00007f0d094e9700 <warng> Config:307         | Cannot find section for [server].filter in config. Using default: {;.*;}
2017-11-30 13:07:27.700884 0x00007f0d094e9700 <trace> DataController:88  | Configuring collectors...
2017-11-30 13:07:27.700899 0x00007f0d094e9700 <trace> EventCollector:22  | ConfigureAndStart invoked for collector: filelog
2017-11-30 13:07:27.700908 0x00007f0d094e9700 <trace> EventCollector:47  | Configuring filelog
2017-11-30 13:07:27.700915 0x00007f0d094e9700 <warng> FLogCollectorEx:380| Cannot find section <filelog> in the configuration. The flat file log collector will stay dormant.
2017-11-30 13:07:27.700925 0x00007f0d094e9700 <trace> EventCollector:49  | Configuration of filelog is done
2017-11-30 13:07:27.700931 0x00007f0d094e9700 <trace> EventCollector:56  | Starting filelog
2017-11-30 13:07:27.700938 0x00007f0d094e9700 <trace> EventCollector:59  | Started filelog
2017-11-30 13:07:27.700944 0x00007f0d094e9700 <trace> DataController:100 | Configuring transport...
2017-11-30 13:07:27.700951 0x00007f0d094e9700 <warng> Config:307         | Cannot find section for [server].proto in config. Using default: cfapi
2017-11-30 13:07:27.700959 0x00007f0d094e9700 <trace> DataController:163 | Creating cfapi transport
2017-11-30 13:07:27.700972 0x00007f0d094e9700 <warng> Config:307         | Cannot find section for [server].hostname in config. Using default: loginsight
2017-11-30 13:07:27.700981 0x00007f0d094e9700 <warng> Config:370         | Cannot find section for [server].ssl in config. Using default: yes
2017-11-30 13:07:27.701011 0x00007f0d094e9700 <warng> Config:256         | Cannot find section for [server].port in config. Using default: 9543
2017-11-30 13:07:27.701024 0x00007f0d094e9700 <warng> Config:256         | Cannot find section for [server].reconnect in config. Using default: 30
2017-11-30 13:07:27.705360 0x00007f0d094e9700 <trace> DataController:104 | Starting transport...
2017-11-30 13:07:27.705460 0x00007f0d094e9700 <trace> AgentDaemon:422    | AgentDaemon configured successfully
2017-11-30 13:07:27.705453 0x00007f0d037fe700 <trace> Logger:188         | Thread "CFApiTransport" has id 0x7f0d037fe700
2017-11-30 13:07:27.705476 0x00007f0d094e9700 <trace> AgentDaemon:367    | AgentDaemon started successfully
2017-11-30 13:07:27.705517 0x00007f0d037fe700 <trace> CFApiTransport:130 | Connecting to server loginsight:9543
2017-11-30 13:07:27.727726 0x00007f0d037fe700 <error> CurlConnection:781 | Transport error while trying to connect to 'loginsight': Couldn't resolve host name
2017-11-30 13:07:27.727758 0x00007f0d037fe700 <trace> CFApiTransport:108 | DoConnectJob [Postpone connection by 1 sec]
2017-11-30 13:07:28.727848 0x00007f0d037fe700 <trace> CFApiTransport:128 | Re-connecting to server loginsight:9543
2017-11-30 13:07:28.731489 0x00007f0d037fe700 <error> CurlConnection:781 | Transport error while trying to connect to 'loginsight': Couldn't resolve host name
2017-11-30 13:07:28.731546 0x00007f0d037fe700 <trace> CFApiTransport:108 | DoConnectJob [Postpone connection by 2 sec]
2017-11-30 13:07:30.731672 0x00007f0d037fe700 <trace> CFApiTransport:128 | Re-connecting to server loginsight:9543
2017-11-30 13:07:30.736886 0x00007f0d037fe700 <error> CurlConnection:781 | Transport error while trying to connect to 'loginsight': Couldn't resolve host name
2017-11-30 13:07:30.736930 0x00007f0d037fe700 <trace> CFApiTransport:108 | DoConnectJob [Postpone connection by 7 sec]
2017-11-30 13:07:37.737023 0x00007f0d037fe700 <trace> CFApiTransport:128 | Re-connecting to server loginsight:9543
2017-11-30 13:07:37.741783 0x00007f0d037fe700 <error> CurlConnection:781 | Transport error while trying to connect to 'loginsight': Couldn't resolve host name
2017-11-30 13:07:37.741816 0x00007f0d037fe700 <trace> CFApiTransport:108 | DoConnectJob [Postpone connection by 11 sec]
2017-11-30 13:07:48.741923 0x00007f0d037fe700 <trace> CFApiTransport:128 | Re-connecting to server loginsight:9543
2017-11-30 13:07:48.747042 0x00007f0d037fe700 <error> CurlConnection:781 | Transport error while trying to connect to 'loginsight': Couldn't resolve host name
2017-11-30 13:07:48.747071 0x00007f0d037fe700 <trace> CFApiTransport:108 | DoConnectJob [Postpone connection by 23 sec]

I know I could configure /var/lib/loginsight-agent/liagent.ini and set a correct hostname in the server section (or hack hosts file and point loginsight to localhost or server IP), but unless it's supposed to use it's own agent to log to it's database, I'd wait. Maybe the agent should be stopped?

Anyone?

[daphnissov]

It's there, yes, but vRLI doesn't yet support pointing its own agent to itself for self-log gathering.

[Joffer]

I know it's there. But if it's not configured correctly, I believe there are only two options - either fix the configuration or stop the agent.

[daphnissov · Accepted solution]

I just stop and disable the agent on my nodes. It should be built that way in the appliance, however.

[admin]

You can open the liagent.ini on the node at location - /var/lib/loginsight-agent/ and comment out the lines for sections its complaining about with a ';' at the beginning of the line or simply stop the liagentd service on the nodes.

[Joffer]

No I can't. The file is empty

If you had read the log output I posted you would see it complains about the _missing_ configuration. Hard to comment out missing stuff :smileysilly::smileylaugh:

[Joffer]

Ok. so no reason it should run then.

I will disable the agent in my log insight server as well then.

/etc/init.d/liagentd stop
chkconfig liagentd off