search

MISP / misp-dashboard

A live dashboard for a real-time overview of threat intelligence from MISP instances
GNU Affero General Public License v3.0
194 stars 65 forks source link

Where is the missing link ? #89

Closed MarimeGui closed 5 years ago

MarimeGui commented 5 years ago

Hello everyone,

I have been trying for the past two weeks to create a "production" MISP environment with all the bells and whistles, including the MISP Dashboard.

However, I cannot figure out how why the Dashboard refuses to work most of the time.

The main MISP web interface works, I can add Events, download feeds, create users... I can access the Dashboard page just fine (it shows the two maps without any issues), but does not do anything after that.

When I publish events to ZMQ from the main MISP page, I can see them being printed to my terminal with the sub.py script along with the Heartbeat messages. I can see the zmq_dispatcher and zmq_subscriber scripts running along with a Redis database on port 6250.

I only got the dashboard to work on a brand new instance installed from the INSTALL script provided in the MISP repo. Sometimes, the Dashbaord would even break without any apparent reason.

I went as far as reinstalling everything manually, following everything in the INSTALL script and replacing Apache2 with Nginx along with php-fpm and a dedicated uWSGI server.

As far as I can see, most relevant configuration files are identical...

Getting it to work on Nginx would be awesome, but I would be fine with Apache2 too.

One of the hints I have encountered but cannot solve was in the /var/www/MISP/app/tmp/logs/error.log:

Warning: Redis::zRangeByScore(): connect() failed: Connection refused in [/var/www/MISP/app/Vendor/kamisama/php-resque-ex-scheduler/lib/ResqueScheduler/ResqueScheduler.php, line 248]

I don't know if this is related, but that is the only error message I could find.

Could anyone try to help me understand what is wrong or what I am doing wrong ? Thanks.

mokaddem commented 5 years ago

Hello and welcome @MarimeGui! I can see them being printed to my terminal with the sub.py script It means that it works on the MISP side. This is already a good step!

I invite you to check in the logs to see where the link is broken, issue #87 may be useful as it describe in order how and where to look in order to debug this kind of issue.

If you manage to solve your issue, please, report how you achieved it in this threat. If you don't manage to solve your issue, tell us how far you went in the debugging.

Cheers!