MISP / misp-dashboard

A live dashboard for a real-time overview of threat intelligence from MISP instances
GNU Affero General Public License v3.0
192 stars 66 forks source link

corrupted redis snapshot and controlled stop procedure for misp-dashboard missing #151

Open pajeco opened 3 years ago

pajeco commented 3 years ago

Hi All,

I have installed misp-dashboard and published around 20k events to ZMQ to update it( it tooks some time having some events with thounsands of attributes ) .

In the mainwhile I did some tests and I had to restart the dashboard many times . I did it this way :

# stop 
# kill dashboard with the axe 

/bin/ps auxwww|grep -i -e DASHENV -e 127.0.0.1:6250 |grep -v grep |awk '{print $2}'|tee /tmp/dashboard_stop.out | xargs kill -9

# start 
# start with script provided 

. start_all.sh

After some time I had zmq_dispatcher.py crashing with error below :

Traceback (most recent call last):                                                                                                                                                                                 
  File "./zmq_dispatcher.py", line 299, in <module>                                                                                                                                                                
    main(args.sleeptime)                            
  File "./zmq_dispatcher.py", line 274, in main     
    process_log(zmqName, content)                   
  File "./zmq_dispatcher.py", line 256, in process_log                                                   
    dico_action[topic](zmq_name, jsonevent)         
  File "./zmq_dispatcher.py", line 170, in handler_event                                                 
    eventName = jsonevent['info']                   
TypeError: string indices must be integers  

After some debugging I found that dump.rdb was corrupted

Indeed after remaming the dump.rdb file start_all.sh activated all the components with success.

Stopping redis with the shutdown command can avoid corrupted snapshots :

/bin/ps auxwww|grep -i -e DASHENV |grep -v grep |awk '{print $2}'|tee /tmp/dashboard_stop.out | xargs kill -9
redis-cli -p 6250 shutdown

this problem brings out the following:

1) a stop procedure for misp-dashboard is missing;
2) error reported above has not been tracked into **logs/logs.log**. 

Best Regards, Daniele Denisi