JPCERTCC / LogonTracer

Investigate malicious Windows logon by visualizing and analyzing Windows event log
Other
2.7k stars 441 forks source link

Logontracer exit status error #110

Closed adimenia closed 3 years ago

adimenia commented 3 years ago

Im trying to start logon tracer using Docker, the image seems to be running but I can't get to the Logontracer web interface. below are some of the logs I'm seeing and it seems logontracer exists every time here is how I ran the docker run --detach --publish=7474:7474 --publish=7687:7687 --publish=8080:8080 -e LHOSTNAME=[192.168.110.137] jpcertcc/docker-logontracer

i can access the Neo4j web interface with no issues.

2021-04-13 12:14:29,855 INFO success: logontracer entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)

2021-04-13 12:14:30,450 INFO exited: logontracer (exit status 2; not expected)

2021-04-13 12:14:31,453 INFO spawned: 'logontracer' with pid 1043

2021-04-13 12:14:32,454 INFO success: logontracer entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)

2021-04-13 12:14:33,124 INFO exited: logontracer (exit status 2; not expected)

2021-04-13 12:14:34,127 INFO spawned: 'logontracer' with pid 1059

2021-04-13 12:14:35,128 INFO success: logontracer entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)

2021-04-13 12:14:35,452 INFO exited: logontracer (exit status 2; not expected)

2021-04-13 12:14:36,454 INFO spawned: 'logontracer' with pid 1075

2021-04-13 12:14:37,456 INFO success: logontracer entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)

2021-04-13 12:14:37,748 INFO exited: logontracer (exit status 2; not expected)

2021-04-13 12:14:38,752 INFO spawned: 'logontracer' with pid 1091

2021-04-13 12:14:39,755 INFO success: logontracer entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)

2021-04-13 12:14:40,061 INFO exited: logontracer (exit status 2; not expected)

2021-04-13 12:14:41,066 INFO spawned: 'logontracer' with pid 1107

2021-04-13 12:14:42,069 INFO success: logontracer entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)

2021-04-13 12:14:42,405 INFO exited: logontracer (exit status 2; not expected)

2021-04-13 12:14:43,407 INFO spawned: 'logontracer' with pid 1123

2021-04-13 12:14:44,409 INFO success: logontracer entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)

2021-04-13 12:14:44,685 INFO exited: logontracer (exit status 2; not expected)

2021-04-13 12:14:45,687 INFO spawned: 'logontracer' with pid 1139

2021-04-13 12:14:46,689 INFO success: logontracer entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)

2021-04-13 12:14:46,974 INFO exited: logontracer (exit status 2; not expected)

2021-04-13 12:14:47,978 INFO spawned: 'logontracer' with pid 1155

2021-04-13 12:14:48,982 INFO success: logontracer entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)

2021-04-13 12:14:49,249 INFO exited: logontracer (exit status 2; not expected)

shu-tom commented 3 years ago

You have an incorrect command line when starting Docker. Try the following command:

docker run --detach --publish=7474:7474 --publish=7687:7687 --publish=8080:8080 -e LHOSTNAME=192.168.110.137 jpcertcc/docker-logontracer
adimenia commented 3 years ago

docker run --detach --publish=7474:7474 --publish=7687:7687 --publish=8080:8080 -e LHOSTNAME=192.168.110.137 jpcertcc/docker-logontracer

that didn't solve the problem, I'm still getting the same issues.

shu-tom commented 3 years ago

I found another typo. Option is LTHOSTNAME, not a LHOSTNAME.