Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Hedgehog - logrotate service not starting #243

Closed
patrickpritchett opened this issue Aug 16, 2023 · 2 comments
Closed

Hedgehog - logrotate service not starting #243

patrickpritchett opened this issue Aug 16, 2023 · 2 comments
Assignees
@mmguero
Labels
arkime Relating to Malcolm's use of Arkime bug Something isn't working sensor For issues dealing with the Hedgehog OS capture sensor
Milestone
v23.09.0

Comments

@patrickpritchett
Copy link

It worked after running:

mkdir /opt/arkime/logs
touch /opt/arkime/logs/capture.log
touch /opt/arkime/logs/viewer.log
touch /opt/arkime/logs/wise.log
touch /opt/arkime/logs/cont3xt.log
touch /opt/arkime/logs/parliament.log
@mmguero mmguero self-assigned this Aug 16, 2023
@mmguero mmguero added arkime Relating to Malcolm's use of Arkime sensor For issues dealing with the Hedgehog OS capture sensor bug Something isn't working labels Aug 16, 2023
@mmguero mmguero added this to the v23.09.0 milestone Aug 16, 2023
@mmguero
Copy link
Collaborator

mmguero commented Aug 16, 2023

Thanks, on Hedgehog the Arkime services (capture and viewer) are not running under systemd so these files shouldn't ever be written to (arkime's actual runtime logs on hedgehog would be found under /opt/sensor/sensor_ctl/log). I'll adjust the installer so that /opt/arkime/logs isn't included in logrotate any more.

mmguero added a commit to mmguero-dev/Malcolm that referenced this issue Aug 16, 2023
@mmguero
remove /opt/logrotate.d/arkime during build of Hedgehog ISO as that's…
7b82df3 
… not where Arkime's log files are going. addresses idaholab#243

Signed-off-by: Seth Grover <mero.mero.guero@gmail.com>
@mmguero
Copy link
Collaborator

mmguero commented Aug 16, 2023

Fixed for v23.09.0 release.

@mmguero mmguero closed this as completed Aug 16, 2023
This was referenced Sep 15, 2023
Merged
Merged
mmguero added a commit to mmguero-dev/Malcolm that referenced this issue Jan 17, 2024
@mmguero
Merge pull request idaholab#243 from mmguero-dev/v23.03.0_merge_cisagov
50cf2eb 
Malcolm v23.03.0 is a release with enhancements, component version updates and bug fixes.

* Enhancements
    - Replace Zeek's [misc/scan.zeek with ncsa/bro-simple-scan](https://github.com/zeek/zeek/blob/cdadc329859810244244c8800f0102543e4f134f/NEWS#L540-L541)
    - terminate `start` and `restart` scripts once Malcolm has started properly (cisagov#240 and cisagov#241, thanks @Njinx)
    - minor usability improvements for ISO-installed Malcolm and Hedgehog (idaholab#155)
        + Added a "Configure Malcolm" menu item (under the "Internet" GTK menu with the other Malcolm stuff) and launcher on the top panel of icons in Malcolm. This runs `./scripts/install.py --configure` in full screen. May look at starting this automatically on first boot in the future. (Malcolm)
        + Added Malcolm shortcut to gtk-3.0/bookmarks so it shows up in Thunar sidebar (Malcolm)
        + Added /opt/sensor/sensor_ctl shortcut to gtk-3.0/bookmarks so it shows up in Thunar sidebar (Hedgehog)
        + Have tilix from launcher panel start in /opt/sensor/sensor_ctl (Hedgehog)
    - minor tweaks to defaults for `install.py --configure` (enable offline-capable file scanners by default)
    - interrupt NetBox startup import script when `netbox-restore` is run
    - added NetBox restore logic to `reset_and_auto_populate.sh` script (used mostly for demos and presentations)

* Component version updates
    - Arkime to [v4.2.0](https://github.com/arkime/arkime/blob/93c89d68b25a4a56f7a6b8099a2661af9648ebaf/CHANGELOG#L39-L66)
    - [OpenSearch](https://github.com/opensearch-project/OpenSearch/blob/bc50a2edcf29c3c41b7a777575c61e1874847d8a/release-notes/opensearch.release-notes-2.6.0.md) and [OpenSearch Dashboards](https://github.com/opensearch-project/OpenSearch-Dashboards/blob/69bcbfeea9bb345364e47f048cd5bcfe64c9c242/release-notes/opensearch-dashboards.release-notes-2.6.0.md) to 2.6.0
    - [Logstash](https://www.elastic.co/guide/en/logstash/current/releasenotes.html) from v8.4.0 to v8.6.1
    - [Beats](https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-8.6.2.html) to v8.6.2
    - Zeek to [v5.0.7](https://github.com/zeek/zeek/releases/tag/v5.0.7)
    - OpenSearch-Py to [v2.2.0](https://github.com/opensearch-project/opensearch-py/releases/tag/v2.2.0) (and remove opensearch-dsl which is now part of opensearch-py)
    - Supercronic to [v0.2.2](https://github.com/aptible/supercronic/releases/tag/v0.2.2)
    - Capa to [v5.0.0](https://github.com/mandiant/capa/releases/tag/v5.0.0)
    - Fluent Bit to [v2.0.9](https://github.com/fluent/fluent-bit/releases/tag/v2.0.9)
    - Version updates to various Python package dependencies

* Fixes
    - last few seconds' Zeek logs prior to log rotation may be lost (idaholab#151)
    - in ISO-packaged Malcolm installation `scripts` directory, symlink `netbox-backup` and `netbox-restore` to `control.py`
    - improve opensearchpy connect/health check logig in `pcap_watcher.py` in `pcap-monitor` container
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@mmguero mmguero

Labels
arkime Relating to Malcolm's use of Arkime bug Something isn't working sensor For issues dealing with the Hedgehog OS capture sensor
Projects
Malcolm
Status: Released
Milestone
v23.09.0
Development

No branches or pull requests
2 participants
@mmguero @patrickpritchett