MISP / misp-dashboard

A live dashboard for a real-time overview of threat intelligence from MISP instances
GNU Affero General Public License v3.0
192 stars 66 forks source link

Dispatcher stop working #178

Open scoluccini opened 6 months ago

scoluccini commented 6 months ago

Hi all,

I recently installed misp-dashboard, normally the services are all up&running, at least according to what './diagnostic.py' states

this is until new events arrive from misp

unfortunately every time new events arrive the dispatcher stops working after inserting one event

restarting the services with 'start_zmq.sh' causes a new event to be downloaded but then the dispatcher stops working again, an so on

furthermore, loaded events always have duplicate Attribute.values

The logs show nothing significant

this is what was reported from the last run

==> zmq_subscriber.log <== INFO:zmq_subscriber:Launching: misptest

==> updates.log <== 2024-02-05 16:58:36,038:INFO:updates:database up-to-date

==> zmq_dispatcher.log <== INFO:updates:database up-to-date INFO:zmq_dispatcher:Handling event ERROR:zmq_dispatcher:'misp_json_tag' ERROR:zmq_dispatcher:'misp_json_tag' ERROR:zmq_dispatcher:'misp_json_tag' ERROR:zmq_dispatcher:'misp_json_tag' ERROR:zmq_dispatcher:'misp_json_tag' ERROR:zmq_dispatcher:'misp_json_tag' ERROR:zmq_dispatcher:'misp_json_tag' ERROR:zmq_dispatcher:'misp_json_tag' INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute

==> helpers.log <== 2024-02-05 16:58:36,121:WARNING:helpers.geo_helper:Can't resolve IP: https://biond.bg/Spidshund.ocx

==> zmq_dispatcher.log <== WARNING:helpers.geo_helper:Can't resolve IP: https://biond.bg/Spidshund.ocx INFO:zmq_dispatcher:Handling event INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute INFO:zmq_dispatcher:Handling attribute

==> helpers.log <== 2024-02-05 16:58:36,182:WARNING:helpers.geo_helper:Can't resolve IP: https://biond.bg/Spidshund.ocx

==> zmq_dispatcher.log <== WARNING:helpers.geo_helper:Can't resolve IP: https://biond.bg/Spidshund.ocx INFO:zmq_dispatcher:Handling event

any ideas ?

Tks S.

P.S. Is it possible to have geolocalization of URLs?