search

DFIRKuiper / Kuiper

Digital Forensics Investigation Platform
772 stars 111 forks source link

Failed To parse Artifacts #79

Closed ahmedkhlief closed 1 year ago

ahmedkhlief commented 2 years ago

Salam Team, Thanks for the tool and your efforts. i did clean install for kuiper and all the services booted without issues . i accessed the web interface uploaded multiple artifacts but all of them failed to parse and tried only uploading MFT file and also failed . i tried to troubleshoot from the logs but no log show the parsing error.

Creating kuiper_redis ... done Creating kuiper_mongodb ... done Creating kuiper_es01 ... done Creating kuiper_celery ... done Creating kuiper_flask ... done Creating kuiper_nginx ... done

image

image

kindly let me know where to troubleshoot the parsing errors .

OS : Ubuntu 22.04.1 LTS Linux 5.15.0-52-generic #58-Ubuntu SMP Thu Oct 13 08:03:55 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

salehmuhaysin commented 2 years ago

hi try to look at kuiper/files/logs/Kuiper.log it has all the logs the issue is failing to push the records to elasticsearch

ahmedkhlief commented 2 years ago

i got the error which indicate there is a disk space issue but the disk have 150GB free , let me know if you have solution: "2022-10-31 12:07:27.837027","[WARNING]","elkdb.py.bulk_to_elasticsearch[Lin.400]","elasticsearch","Index [test]: Failed pushing record: ","{u'index': {u'status': 429, u'_type': u'_doc', u'_id': u'5b3b3939-fca1-4b79-be49-49609f71aec4', u'error': {u'reason': u'index [test] blocked by: [TOO_MANY_REQUESTS/12/disk usage exceeded flood-stage watermark, index has read-only-allow-delete block];', u'type': u'cluster_block_exception'}, u'_index': u'test'}}"

salehmuhaysin commented 2 years ago

try 

sudo docker-compose down
sudo docker-compose up

it might fix the issue could be the limit of disk write speed caused issue in elasticsearch