Skip to content
This repository has been archived by the owner on Apr 16, 2021. It is now read-only.

sostat: check for stuck ELSA cron.pl #1061

Closed
dougburks opened this issue Jan 12, 2017 · 4 comments
Closed

sostat: check for stuck ELSA cron.pl #1061

dougburks opened this issue Jan 12, 2017 · 4 comments

Comments

@dougburks
Copy link
Contributor

Related to #1059, we need an additional sostat check in the ELSA section which displays the age (or start time) of the running cron process as well as archive errors in the log.
@weslambert
Copy link
Collaborator

Are there any specific archive errors to look out for? I'm was thinking a grep for 'failed|* ERROR|Duplicate entry' would suffice, but did you have anything else in mind? Would a lookup of saved_results (based on a duplicate qid error in web.log) be useful as well?

@dougburks
Copy link
Contributor Author

Hey Wes,

Sounds good, thanks!

@weslambert weslambert mentioned this issue Feb 18, 2017
Merged
@dougburks
Copy link
Contributor Author

dougburks commented Jun 23, 2017 •
edited

submitted for testing:
https://groups.google.com/d/topic/security-onion-testing/de_uJ652_jY/discussion

@dougburks
Copy link
Contributor Author

published:
http://blog.securityonion.net/2017/06/securityonion-sostat-20120722.html

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@dougburks @weslambert