Event pushed between local servers contains no attributes

[timhux123]

| Type of issue | Support | OS version (server) | Ubuntu | OS version (client) | Win10 | PHP version | 7.2 | MISP version / git hash | v2.4.126 (69f606a6c09d0c8b6bda23f7559757492fa5cecc)

New issue has started to appear, and I cannot find any visible configuration problem. The issue does not happen to all events.

I have 2 local MISP servers. Events are pulled into Server A from the external MISP CIRCL server. Attributes are added and enriched, and the event is pushed to Server B. Server B receives the event successfully, but the event contains no attributes. The event does contain galaxies (sector, actor, mitre attack). The distribution level for the event on Server A is set to "All communities" and the attributes are set to "Inherit". Other events are configured on Server A with the same distribution level and have no issues with the attributes pushing to Server B. I can manually export this event on Server A and manually import it into Server B and the attributes do input with the event.

The following is seen on Server B while viewing the event with no attributes:

"Attribute warning: This event doesn't have any attributes visible to you. Either the owner of the event decided to have a specific distribution scheme per attribute and wanted to still distribute the event alone either for notification or potential contribution with attributes without such restriction. Or the owner forgot to add the attributes or the appropriate distribution level. If you think there is a mistake or you can contribute attributes based on the event meta-information, feel free to make a proposal".

Screenshot of above warning:

The following error on Server B in the MISP error.log at the exact time the event is pulled in:

Error: [PDOException] SQLSTATE[22003]: Numeric value out of range: 1690 BIGINT UNSIGNED value is out of range in '(misp.Event.attribute_count - 1)' Request URL: /events Stack Trace:

0 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Datasource/DboSource.php(502): PDOStatement->execute(Array)

1 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Datasource/DboSource.php(468): DboSource->_execute('UPDATE misp.`...', Array)

2 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Datasource/Database/Mysql.php(425): DboSource->execute('UPDATE misp.`...')

3 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Model.php(2672): Mysql->update(Object(Event), 'Event.attrib...', NULL, ' WHEREEvent`....')

4 /var/www/MISP/app/Model/Attribute.php(665): Model->updateAll(Array, Array)

5 /var/www/MISP/app/Model/Attribute.php(686): Attribute->__alterAttributeCount('596', false)

6 /var/www/MISP/app/Lib/cakephp/lib/Cake/Event/CakeEventManager.php(242): Attribute->afterSave(true, Array)

7 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Model.php(1970): CakeEventManager->dispatch(Object(CakeEvent))

8 /var/www/MISP/app/Lib/cakephp/lib/Cake/Model/Model.php(1760): Model->_doSave(Array, Array)

9 /var/www/MISP/app/Model/Attribute.php(4047): Model->save(Array, Array)

10 /var/www/MISP/app/Model/Event.php(3650): Attribute->captureAttribute(Array, '596', Array, 0, Object(Log), Array)

11 /var/www/MISP/app/Controller/EventsController.php(2005): Event->_add(Array, true, Array, '', NULL, false, NULL, 0, Array)

12 [internal function]: EventsController->add()

13 /var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(499): ReflectionMethod->invokeArgs(Object(EventsController), Array)

14 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(193): Controller->invokeAction(Object(CakeRequest))

15 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke(Object(EventsController), Object(CakeRequest))

16 /var/www/MISP/app/webroot/index.php(92): Dispatcher->dispatch(Object(CakeRequest), Object(CakeResponse))

17 {main}

---

I also notice the following in error.log on Server A. "297133" in the error below is the event id for the event on Server A that is pushed to Server B with no attributes.

Error: [MethodNotAllowedException] You do not have permission to use this functionality. Request URL: /events/checkLocks/297133 Stack Trace:

0 /var/www/MISP/app/Controller/Component/ACLComponent.php(746): ACLComponent->__error()

1 /var/www/MISP/app/Controller/AppController.php(525): ACLComponent->checkAccess()

2 /var/www/MISP/app/Controller/EventsController.php(59): AppController->beforeFilter()

3 /var/www/MISP/app/Lib/cakephp/lib/Cake/Event/CakeEventManager.php(244): EventsController->beforeFilter()

4 /var/www/MISP/app/Lib/cakephp/lib/Cake/Controller/Controller.php(682): CakeEventManager->dispatch()

5 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(189): Controller->startupProcess()

6 /var/www/MISP/app/Lib/cakephp/lib/Cake/Routing/Dispatcher.php(167): Dispatcher->_invoke()

7 /var/www/MISP/app/webroot/index.php(92): Dispatcher->dispatch()

8 {main}

---

Update - June 01, 2020 - Made progress on this issue. I noticed the event on Server A contained attributes I soft deleted from the event. I permanently deleted these attributes and re-published the event. The event on Server B now contains all the attributes.

[mokaddem]

Error: [PDOException] SQLSTATE[22003]: Numeric value out of range: 1690 BIGINT UNSIGNED value is out of range in '(misp.Event.attribute_count - 1)'

This is indeed weird. It should be resolved whenever the Event.attribute_count issue is fixed.

Error: [MethodNotAllowedException] You do not have permission to use this functionality.
Request URL: /events/checkLocks/297133

This is fine. I guess you let open the page for too long and you got sign out automatically.

Aside for the first issue, everything is working as expected now?

[timhux123]

Thanks for the information. Everything is working as long as I hard delete the attributes I don't need before pushing the event from Server A to Server B. If the attributes are soft deleted the pushed event to Server B contains no attributes.