csirtgadgets / massive-octo-spice

DEPRECATED - USE v3 (bearded-avenger)
https://github.com/csirtgadgets/bearded-avenger-deploymentkit/wiki
GNU Lesser General Public License v3.0
227 stars 60 forks source link

cif-worker error #182

Closed wesyoung closed 9 years ago

wesyoung commented 9 years ago

need to re-check, dump out what it's choking on....

[2015-03-20T01:24:32,299Z][ERROR]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 27.
 at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
giovino commented 9 years ago

Alpha-17

How come you closed this? I'm still seeing it:

cif-worker.log:[2015-03-20T02:14:48,037Z][ERROR]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 27.
cif-worker.log: at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
cif-worker.log:[2015-03-21T02:24:04,557Z][ERROR]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 27.
cif-worker.log: at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
cif-worker.log:[2015-03-21T23:38:56,457Z][ERROR]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 27.
cif-worker.log: at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
cif-worker.log:[2015-03-21T23:39:02,619Z][ERROR]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 27.
cif-worker.log: at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
cif-worker.log:[2015-03-22T02:07:33,381Z][ERROR]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 27.
cif-worker.log: at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
cif-worker.log:[2015-03-22T02:13:40,279Z][ERROR]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 27.
cif-worker.log: at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
cif-worker.log:[2015-03-22T02:30:44,588Z][ERROR]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 27.
cif-worker.log: at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
wesyoung commented 9 years ago

cause i thought i fixed it...

wesyoung commented 9 years ago
[2015-03-24T01:30:57,386Z][ERROR][main:274]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 27.
 at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
[2015-03-24T01:30:57,386Z][DEBUG][main:275]: $VAR1 = '{
   "protocol" : 6,
   "provider" : "openphish.com",
   "group" : [
      "everyone"
   ],
   "portlist" : null,
   "firsttime" : "2015-03-24T01:05:37Z",
   "id" : "35e2e70dc781ac95cde7c767839f39754ebd88f74984ba92d305fced90ea801d",
   "altid_tlp" : "green",
   "lasttime" : "2015-03-24T01:05:37Z",
   "tlp" : "amber",
   "@timestamp" : "2015-03-24T01:05:37.180Z",
   "observable" : "xn----jtbbmekqknepg3a.xn--p1ai",
   "application" : null,
   "tags" : [
      "phishing"
   ],
   "related" : "1734123fbbb4fe56d27c19980c6181555c0dbdf991f25edbc14491a2f67886a5",
--
[2015-03-24T01:33:01,323Z][ERROR][main:274]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 27.
 at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
[2015-03-24T01:33:01,323Z][DEBUG][main:275]: $VAR1 = '{
   "protocol" : 6,
   "provider" : "openphish.com",
   "group" : [
      "everyone"
   ],
   "portlist" : null,
   "firsttime" : "2015-03-24T01:05:51Z",
   "id" : "2c85e11f9e7a1dfc3e2bb2fc6ffd4715cd98f6d793ca67088d6cc47222a97705",
   "altid_tlp" : "green",
   "lasttime" : "2015-03-24T01:05:51Z",
   "tlp" : "amber",
   "@timestamp" : "2015-03-24T01:05:51.862Z",
   "observable" : "xn----jtbbmekqknepg3a.xn--p1ai",
   "application" : null,
   "tags" : [
      "phishing"
   ],
   "related" : "0b7582bbb14c2edee3260e3c43a6bcc06a5a7ff07410adf8dac4599d905272c3",

fuck me.

giovino commented 9 years ago

I'm seeing this again in beta2. I'm reopening this issue and I've enabled debugging. I'll post more when I find the offending data point.

wesyoung commented 9 years ago

ack, i have yet to see it in my test instance (fwiw).

wesyoung commented 9 years ago

nope, i lied:

[2015-04-07T13:32:03,496Z][ERROR][main:274]: Unable to find a suitable class at /opt/cif/bin/../lib/perl5/CIF/ObservableFactory.pm line 31.
 at /opt/cif/bin/../lib/perl5/CIF/Worker.pm line 154.
[2015-04-07T13:32:03,497Z][DEBUG][main:275]: $VAR1 = '{
   "protocol" : 6,
   "provider" : "phishtank.com",
   "group" : [
      "everyone"
   ],
   "portlist" : null,
   "firsttime" : "2015-04-07T13:31:10Z",
   "id" : "83e42e6ba2bf7e5d2db24794c0e90b7861421f54e4ecbfe82676b0123f782fd1",
   "altid_tlp" : "green",
   "lasttime" : "2015-04-07T13:31:09Z",
   "tlp" : "amber",
   "@timestamp" : "2015-04-07T13:31:10.223Z",
   "observable" : "taxID-1187411041.cra-arc.gc.ca.gmisb.com",
   "application" : [
      "http",
      "https"
   ],
   "tags" : [
      "phishing"
   ],
   "related" : "69d6195ab076e1022bda312a4b21926b3995b927b0d104cee0b037724917e086",
   "@version" : 2,
   "reporttime" : "2015-04-07T13:31:09Z",
   "confidence" : 60.764,
   "altid" : "http://data.phishtank.com/data/online-valid.json.gz"
}
';