search

OpenCTI-Platform / opencti

Open Cyber Threat Intelligence Platform
https://opencti.io
Other
6.32k stars 932 forks source link

Data ingestion failing #4024

Closed openctitest closed 8 months ago

openctitest commented 1 year ago

Description

Data synchronization not completing between main opencti instance and sub instances

Environment

  1. OS (where OpenCTI server runs): { e.g. Mac OS 10, Windows 10, Ubuntu 16.4, etc. } Centos 7
  2. OpenCTI version: { e.g. OpenCTI 1.0.2 } OpenCTI 5.9.5
  3. OpenCTI client: { e.g. frontend or python } frontend
  4. Other environment details: Running as docker containers

Reproducible Steps

We have 3 clusters of OpenCTI, one is the main and two are secondary. The main runs a data data sharing stream and the two secondary have ingests set up. The synchronization starts but is not completing. At the time it stops the following error is seen in the logs:

ERR [OPENCTI-MODULE] Error executing notification manager (live) | category=APP error{"context":{"category":"business", "http_status":500, "reason":"No representative extractor available of User"}, "message":"Unsupported operation","name":"Unsupported operation","name":"UnsupportedError","stack":"UnsupportedError: Unsupported operation\n at error (/opt/opencti/build/src/config/errors.js:8:10)\n at UnsupportedError (/opt/opencti/build/src/config/errors.js:76:51) ... at processingLoop (/opt/opencti/build/src/database/redis.ts:67:13)"} timestamp=2023-08-09T11:48:47.324Z version=5.9.5

Expected Output

Expect synchronization to occur

Actual Output

Synchronization is not completing

Additional information

Archidoit commented 1 year ago

Hello! Can you indicate which triggers you have?

openctitest commented 1 year ago

I'm not sure exactly what information you need here, on the main instance of opencti I have a live stream set to public with no filters applied

Archidoit commented 1 year ago

Can you provide the stream events that are just before the timestamp of your error?

Can you also indicates if you have triggers ? Triggers can be found by following these steps:

openctitest commented 1 year ago

Thanks for the info. I do not see any stream events and there are no triggers

RomuDeuxfois commented 1 year ago

Hi,

About stream events, you don't have any in your redis? If you have redis-insight, you can view all events on the platform.

image

nino-filigran commented 8 months ago

@openctitest is this issue still needed?

Jipegien commented 8 months ago

closed for no activity