snorby 2.6.2 -- All Unclasified events results into Error

[neutrino1]

hi When i click "events->filter options->all unclassified events", a page with error message appears. It should display all unclassified events but it displays an error message, in my event page i can only view unique unclassified events ONLY.

i am observing 9 events on low severity graph where as when i click the graph it displays 7 events.

truncated the cache table in mysql and restarted the jobs and worker but result was still the same

Debian Squeeze Snort 2.9.12 Snorby 2.6.2

Please guide.

[jthoel]

I don't get that error message. My unclassified events show up. Plus, Clicking on "Events" only ever shows you unclassified events by default; the difference being when you do "All Unclassified" it seems to ungroup the common sessions.

What is the error message? Anything in the snorby logs?

On Fri, Dec 6, 2013 at 9:08 AM, neutrino1 notifications@github.com wrote:

hi When i click "events->filter options->all unclassified events", a page with error message appears. It should display all unclassified events but it displays an error message, in my event page i can only view unique unclassified events ONLY.

i am observing 9 events on low severity graph where as when i click the graph it displays 7 events.

truncated the cache table in mysql and restarted the jobs and worker but result was still the same

Debian Squeeze Snort 2.9.12 Snorby 2.6.2

Please guide.

— Reply to this email directly or view it on GitHubhttps://github.com/Snorby/snorby/issues/329 .

[neutrino1]

On web page i see message "We are sorry, but something went wrong ....etc". production logs are as following; Processing by EventsController#index as HTML Rendered events/_menu.html.erb (2.6ms) Rendered events/_menu.html.erb (0.6ms) Rendered events/_event.html.erb (66.9ms) Rendered events/_events.html.erb (77.6ms) Rendered events/index.html.erb within layouts/application (82.5ms) Completed 500 Internal Server Error in 89ms

ActionView::Template::Error (undefined method ip_src' for nil:NilClass): 1: <li data-signature-id="<%= event.signature.sig_sid.to_i %>" data-agent-id="<%= event.sensor.sid %>" data-session-id="<%= event.ip.ip_src %>_<%= event.ip.ip_dst %>_<%= event.signature.sig_id %>" id='event_<%= event.sid %><%= event.cid %>' class='event' data-event-id='<%= event.id %>' data-event-sid='<%= event.sid %>' data-event-cid='<%= event.cid %>'> 2: 3: <% classification_css = event.classification.blank? ? nil : "classified" %> 4: app/views/events/_event.html.erb:1:in_app_views_eventsevent_html_erb233980399_87913670' app/views/events/_events.html.erb:51:in block in _app_views_events__events_html_erb__102526165_88981860' app/views/events/_events.html.erb:3:in_app_views_eventsevents_html_erb102526165_88981860' app/views/events/index.html.erb:13:in _app_views_events_index_html_erb__1044245736_90231700' app/controllers/events_controller.rb:14:inblock (2 levels) in index' app/controllers/events_controller.rb:13:in `index'

Any idea??