ELASTIC_HOST/PORT still needed for docker-compose setup to work #2103
Comments
|
Hi, I am wondering why this occures. I have another fresh timesketch running since two days and after I recognized the issue#2097 just altered the variable names to OPENSEARCH_HOST and OPENSEARCH_PORT in the etc/timesketch.conf file and after a restart of timesketch by docker-compose everything works fine. So I expected the modification to the deploy-script which bringing the right variable names and settings in the etc/timesketch.conf file will be enough. And I am quite sure I tested that it works fine, yesterday. Suprisingly the error logs occured in worker.log only the first time. After that errors where logged in wsgi_error.log. ==== worker.log extract ==== ==== wsgi_error.log ==== [2022-01-11 21:34:21,852] timesketch.app/ERROR Exception on /api/v1/sketches/3/ [GET] During handling of the above exception, another exception occurred: Traceback (most recent call last): During handling of the above exception, another exception occurred: Traceback (most recent call last): During handling of the above exception, another exception occurred: Traceback (most recent call last): During handling of the above exception, another exception occurred: Traceback (most recent call last): ==== Files with ELASTIC_HOST and ELASTIC_PORT ==== -> % grep -r "ELASTIC_HOST" -> % grep -r "ELASTIC_PORT" |
|
I checked it again and I still confirm timesketch is running into errors while opening a new sketch. But I cannot confirm : Add ELASTIC_HOST and ELASTIC_PORT to timesketch.conf and restart timesketch containers That didn't worked on my system. Also checked the timesketch at my other system. It is still running fine with the previously patched OPENSEARCH_HOST setting. But as I said I just fixed it on this system directly in the config file and did not run the deployment skript again. |
|
Here are some of my observations in researching the issue with networking issues in the latest timesketch/opensearch release. I hope they help some and reduces the research time for others working on this. I made the updates to the docker-compose.yml that were consistent with the prior release of timesketch/elasticsearch and although the network stats look like the should work, they do not. I provide results before and after the updates to the docker-compose.yml file. The docker-compose.yml, as created by deploy_timesketch.sh This file does not have ports settings for opensearch. These results which obviously won't work as there is nothing listening on port 9200. From docker-compose.yml The ports were added to this version of the file. The output below is after I updated docker-compose.yml to add ports 9200 & 9300. Observation - of standard config created by deploy_timesketch.sh
|
|
Okay, let's try to filter out some info.
So in a docker-compose setup you can have a container (opensearch) start a service listenening on port 9200 and all other containers are able to connect to it using eg You can test this by getting a shell in one of the containers (eg Hope that clarifies some networking things. See https://docs.docker.com/compose/networking/#multi-host-networking |
|
hacktobeer, thanks so much. that does help fill in some of the holes in my docker networking knowledge. i was on that path but the issue is that the ping command is not in these containers; neither is apt or apt-get. I'm not sure what the base image is that is being used. These containers are different than the timesketch/elasticsearch containers that do have Back the issue at hand. We know that the docker-compse.yml needs to have the ports added to the opensearch section. I did that, but that still does not fix the problem. My simple test is can I reach opensearch from my browser http://localhost:9200 Which I can not do even after making the ports change to the docker-compose.yml and restarting all the containers. From all the network data the I collected I can't find anything glaring wrong. Thoughts? Since this is more conversational, what do you think about moving this to the Open Source DFIR Slack Workspace? |
|
Let's move to Slack. Last comments on this:
- opensearch does not need ports defined in the configuration as it does
not need exposure to the host (aka outside of the docker-compose network).
- if you can connect from inside one of the timesketch containers to
opensearch it all works networking wise.
…On Wed, Jan 12, 2022, 18:18 Mark Hallman ***@***.***> wrote:
hacktobeer, thanks so much. that does help fill in some of the holes in my
docker networking knowledge. i was on that path but the issue is that the
ping command is not in these containers; neither is apt or apt-get. I'm not
sure what the base image is that is being used. These containers are
different than the timesketch/elasticsearch containers that do have ping.
All of the container to container networking can be verified in those
containers because the tool are there. Ideas on other approaches to test
container to container networking?
***@***.***:~#
***@***.***:~# docker exec -u root -it opensearch /bin/bash
bash-4.2# ping timesketch-web
bash: ping: command not found
bash-4.2#
Back the issue at hand. We know that the docker-compse.yml needs to have
the ports added to the opensearch section. I did that, but that still does
not fix the problem. My simple test is can I reach opensearch from my
browser http://localhost:9200 Which I can not do even after making the
ports change to the docker-compose.yml and restarting all the containers. docker-compose
down && docker-compose up -d
From all the network data the I collected I can't find anything glaring
wrong. Thoughts?
Since this is more conversational, what do you think about moving this to
the Open Source DFIR Slack Workspace?
—
Reply to this email directly, view it on GitHub
<#2103 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABP5D4AA72BMUG4FSUTX3SDUVWZXLANCNFSM5LWVXSWA>
.
Triage notifications on the go with GitHub Mobile for iOS
<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675>
or Android
<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.
You are receiving this because you authored the thread.Message ID:
***@***.***>
|
|
AFAIK this bug has been fixed with #2099 If it remained please feel free to re-open |
Describe the bug
When following the below quick start guide to install Timesketch it will not work as it still tries to search for ELASTIC_HOST and ELASTIC_PORT.
To Reproduce
Steps to reproduce the behavior:
Expected behaviour
I expect the setup guide to give me a working Timesketch setup ;)
Desktop (please complete the following information):
The text was updated successfully, but these errors were encountered: