airbus-cyber / graylog-plugin-alert-wizard

Alert Wizard plugin for Graylog to manage the alert rules
Other
45 stars 7 forks source link

Deleting stream broke plugin #105

Closed shokkakhan closed 10 months ago

shokkakhan commented 1 year ago

Hello -

I deleted a stream that was created by this plugin, this then broke the plugin. When I go to the 'Wizard/Alert Rules' page it provides me with an error saying that a stream cannot be found. The page just says loading, and I cannot create or manage any other alerts.

Fetching alert rules failed with status: FetchError: There was an error fetching a resource: Not Found. Additional information: org.graylog2.database.NotFoundException: Stream <63a49f20b06e4e56429738a7> not found!

shokkakhan commented 1 year ago

How can I completely remove any traces of this plugin from my Graylog instance? I would like to start fresh.

Removing the .jar file does not uninstall the plugin. The old data is still there, and the drop down menu is still seen at the top of the page.

frantz45 commented 1 year ago

Hello,

I confirm the bug, deleting a Stream (or an Event Definition or a Notification) should not prevent the load of rules. In previous versions of this plugin it wasn't the case, the problematic rule appeared in red with a "altered" status and we could remove it. We'll check it and fix it.

If you want to delete to problematic rule in order to recover the access to this plugin web UI:

frantz45 commented 10 months ago

I've tested with Wizard v5.1.0 and I confirm it's fixed