Replayer Generating Blank File

[aweinograd]

We use replayer to save session history and have done so successfully for a while. Since we upgraded from 2020.2.4 to 2021.3.2 (and since then 2021.3.6), the replayer output has produced empty files.

We had been using 4.2 but tried 4.2.1 with the same results Here is the output from the command line

`info: LogShark.Plugins.Replayer.ReplayerPlugin[0] => 22010904034669-redacted Processing 0 apache source lines and 166 begin command controller, 232 server telemetry, 6540 lock session, 0 end bootstrap vizqlserver events info: LogShark.Plugins.Replayer.ReplayerPlugin[0] => 22010904034669-redacted Serializing Json replay sessions info: LogShark.Plugins.Replayer.ReplayerPlugin[0] => 22010904034669-redacted Writing to Json file ReplayerOutput\Playback_09_01_-04-03-47.json info: LogShark.TableauLogsProcessor[0] => 22010904034669-redacted Completed reading log set and generating data info: LogShark.Shared.LogReading.TableauLogsExtractor[0] => 22010904034669-redacted Disposing log extractor temporary files... info: LogShark.Shared.LogReading.TableauLogsExtractor[0] => 22010904034669-redacted Log extractor temporary files disposed info: LogShark.LogSharkRunner[0] => 22010904034669-redacted Plugins that had any data sent to them: Replayer info: LogShark.Writers.Hyper.HyperWorkbookGenerator[0] => 22010904034669-redacted Starting to generate workbooks with results... fail: LogShark.LogSharkRunner[0] => 22010903210960-redacted No workbooks were generated successfully. info: LogShark.Program[0]

  -----Summary-----
  Run ID 22010903210960-Redacted failed after running for 00:02:02.8086486. Reported problem: No workbooks were generated successfully.
  This problem is unexpected and it is not known whether or not it will go away if LogShark is run again.
  Information below might contain more details on what exactly failed
  LogShark version: 4.2.1.0

  -----Processing errors-----
  No errors occurred while processing log set

  -----Generated workbooks-----
  Workbook templates available: Apache; Art; ArtDesktop; Backgrounder; ClusterController; Config; DataServer; Filestore; Hyper; Netstat; Postgres; ResourceManager; SearchServer; ServerTelemetry; Tabadmin; TabadminController; Vizportal; VizqlDesktop

  -----Log Reading Statistics-----
  Processed zip file compressed size: 804 MB
  Plugins that received any data: Replayer

  Apache                                            : Processed 3 files in 00:00:26.4349618. Elapsed: 00:00:26.4349618. Total size: 30 MB. Processing at 1.13 MB/sec
  VizqlserverCpp                                    : Processed 13 files in 00:01:35.3005701. Elapsed: 00:01:35.3005701. Total size: 2012 MB. Processing at 21.11 MB/sec

  -----Data Writers Statistics-----`

I don't believe that there is an actual error here, since we are looking for just the Replayer output not any Workbooks. Logshark runs successfully on it's own. The configuration on the machine we are running this on hasn't changed in a year. I tried using the logs sent to help triage this issue and they produce an output: https://github.com/tableau/Logshark/issues/122

There is nothing in the logs or console output that show an error.

[aweinograd]

After doing some debugging against the source code, it appears that the Regex for Apache at a minimum are not matching any records from our logs and thinks that there are no sessions. Comparing logs I have from the older 2020.2 server and the 2021.3 version, there is an extra column in the apache logs which isn't accounted for.

When I edit this: https://github.com/tableau/Logshark/blob/e287d80d5a57ab193dd1ff938a2a1ed84a2dc230/LogShark/Plugins/Shared/ApacheEventParser.cs#L32 it works

[til-jmac]

+1 Can confirm, had the same issue with no data written to the Apache workbook. Updating the code as described and recompiling has fixed it.

[Stgocf]

thx you everyone, i'm with the same issue! i'm using logshark for Windows and i can't find the ApacheEventParser.cs

i will use the compile yourself option for testing

[Stgocf]

@aweinograd, @til-jmac do you have some time to help me with this?, i already change the line 32 (2021.3 section) , but when i'm running i'm still getting an empty json, looking in the logs i see this exception millions times

" Exception The given key '+0000' was not present in the dictionary. for url ...... "

i don't know what to do... thx you very much...

[Ssaranng]

After doing some debugging against the source code, it appears that the Regex for Apache at a minimum are not matching any records from our logs and thinks that there are no sessions. Comparing logs I have from the older 2020.2 server and the 2021.3 version, there is an extra column in the apache logs which isn't accounted for.

When I edit this:

https://github.com/tableau/Logshark/blob/e287d80d5a57ab193dd1ff938a2a1ed84a2dc230/LogShark/Plugins/Shared/ApacheEventParser.cs#L32

it works

Hello @aweinograd,

I'm running Tableau server 2021.4.7 and i'm encoutering the same issue than you. Can you share what are the exact changes that you did to fix the issue? (i'm using the the precompiled self-contained application) I have tested with the log zip file from https://github.com/tableau/Logshark/issues/122 and the replay file was not empty