Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

More explicit error message for invalid scenario #47

Closed
buixor opened this issue May 29, 2020 · 0 comments · Fixed by #49
Closed

More explicit error message for invalid scenario #47

buixor opened this issue May 29, 2020 · 0 comments · Fixed by #49
Labels
kind/enhancement New feature or request

Comments

@buixor
Copy link
Contributor

buixor commented May 29, 2020

When a scenario fails to be loaded (ie. because the filter is incorrect), the error message could make the incriminated scenario more obvious.

Currenty:

time="29-05-2020 13:19:54" level=error msg="Failed to load bucket : invalid filter 'evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('sqli_probe_patterns.txt'), {Upper(evt.Parsed.http_args) contains Upper(#)})' in /etc/crowdsec/config/scenarios/http-sqli-probing.yaml : unknown func Upper (1:101)\n | evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('sqli_probe_patterns.txt'), {Upper(evt.Parsed.http_args) contains Upper(#)})\n | ....................................................................................................^"
time="29-05-2020 13:19:54" level=fatal msg="Scenario loading failed : loadBucket failed : invalid filter 'evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('sqli_probe_patterns.txt'), {Upper(evt.Parsed.http_args) contains Upper(#)})' in /etc/crowdsec/config/scenarios/http-sqli-probing.yaml : unknown func Upper (1:101)\n | evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('sqli_probe_patterns.txt'), {Upper(evt.Parsed.http_args) contains Upper(#)})\n | ....................................................................................................^"

Mentioning directly that "the scenario crowdsecurity/http-sqli-probing failed to be load because ..." would make user's life easier !

@buixor buixor added the kind/enhancement New feature or request label May 29, 2020
buixor added a commit that referenced this issue Jun 1, 2020
@buixor buixor mentioned this issue Jun 1, 2020
AlteredCoder pushed a commit that referenced this issue Jun 1, 2020
registergoofy pushed a commit that referenced this issue Sep 7, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant