acouvreur / ssh-log-to-influx

Send SSH authentication logs to influxdb with geohashing IP
GNU General Public License v3.0
101 stars 25 forks source link

works but with an error #172

Closed nmcc1212 closed 2 years ago

nmcc1212 commented 2 years ago

it runs fine but when i did the test using netcat and Failed password for username from 206.253.167.10 port 11111 ssh2 the docker logs show the following error

Failed password for username from 206.253.167.10 port 11111 ssh2
(node:1) UnhandledPromiseRejectionWarning: Error: Internal Server Error
    at once (/app/node_modules/influx/lib/src/pool.js:243:49)
    at ClientRequest.<anonymous> (/app/node_modules/influx/lib/src/pool.js:66:13)
    at Object.onceWrapper (events.js:286:20)
    at ClientRequest.emit (events.js:203:15)
    at HTTPParser.parserOnIncomingClient [as onIncoming] (_http_client.js:565:21)
    at HTTPParser.parserOnHeadersComplete (_http_common.js:111:17)
    at Socket.socketOnData (_http_client.js:451:20)
    at Socket.emit (events.js:198:13)
    at addChunk (_stream_readable.js:288:12)
    at readableAddChunk (_stream_readable.js:269:11)
(node:1) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). (rejection id: 1)
(node:1) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.
acouvreur commented 2 years ago

The webservice used to retrieve geolocation might be unavailable? I should consider using a èlocal database such as https://dev.maxmind.com/geoip/geolite2-free-geolocation-data

nmcc1212 commented 2 years ago

i dont think this is the case becuase when i checked grafana it showed the correct location image