5 Replies Latest reply: Jul 18, 2017 8:32 AM by cmd1775 RSS

LCE 5.0.1

cmd1775 Apprentice

I am getting the message "Error fetching metadata of current silo; cannot proceed" on LCE 5.0.1. I have restarted the serves and still get the same message. LCE isn't out of drive space.

SecurityCenter isn't able to pull any event data from LCE.

Any idea what this message means?

  • Re: LCE 5.0.1
    ldavidson Expert

    Hi Chris,

     

    It sounds like something is wrong with the Elasticsearch index for the current silo.  Is Elasticsearch running and OK?  To gather a bit more info, you could run these commands:

     

    /opt/lce/tools/lce_cfg_utils --update debug 80000

    /opt/lce/tools/lce-reload-conf.sh lce_server

    curl -X GET 'http://127.0.0.1:9200/current_silo/_alias'


    That will add some debugging into the logs and also check to see if the alias is healthy.  If you get a "siloX" that comes back from that third line, that's the current silo, and you can check one more thing with:


    curl -X GET 'http://127.0.0.1:9200/siloX/silo_status/_search'


    Just be sure to replace the X with the right number from the previous query.  This will give us some metadata about the current silo, like the earliest and latest times of events in the index.  If anything is missing, it'll tell us how to fix it.  Let me know what you see.


    - Mike

    • Re: LCE 5.0.1
      cmd1775 Apprentice

      Mike,

       

      After entering curl -X GET 'http://127.0.0.1:9200/current_silo/_alias' I get:

      {"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"current_silo","index":"current_silo"}],"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"current_silo","index":"current_silo"},"status":404}

      • Re: LCE 5.0.1
        ldavidson Expert

        Hi Chris,

         

        It looks like the alias is gone entirely.  Run:

        curl -X GET 'http://127.0.0.1:9200/_cat/indices?v'

        and then we should be able to see which indices are there and which should have the current_silo alias.  Was this an upgrade that was working and something happened, or did you upgrade and have issues immediately? 

        • Re: LCE 5.0.1
          cmd1775 Apprentice

          Mike,

           

          When I run the command you ask me to run, I get - health status index pri rep docs.count docs.deleted store.size pri.store.size

          Then when I run curl -X GET 'http://127.0.0.1:9200/current_silo/_alias' I still get {"error":{"root_cause":[{"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"current_silo","index":"current_silo"}],"type":"index_not_found_exception","reason":"no such index","resource.type":"index_or_alias","resource.id":"current_silo","index":"current_silo"},"status":404}


           

           

          This was a fresh install. Everything seemed to be work just fine. Then I was unable to retrieve events from LCE and I noticed the error message I posted in my original post.

          • Re: LCE 5.0.1
            cmd1775 Apprentice

            Mike,

             

            I opened a support case on this. They had me run the following commands on LCE:

            # /opt/lce/tools/stop_lce

             

            # service elasticsearch stop

             

            # /opt/lce/tools/setup-single-node.sh --setup-es

             

            # service elasticsearch start

             

            # /opt/lce/tools/start_lce

             

            LCE seems to be working now. Not sure what happened to Elasticsearch to cause the errors I was seeing..