search

cuckoosandbox / community

Repository of modules and signatures contributed by the community
324 stars 175 forks source link

Some tasks are not reported #482

Open claudioquincy opened 4 years ago

claudioquincy commented 4 years ago

On Cuckoo 2.0.7 some tasks (very few) are just completed, but not reported. A screenshot from the web GUI: immagine

I got 2 separated instances on supervisord (40 VMs), and everything runs smooth except for this, sometimes it just miss a report and i can't understand why.

Logs are ok, no issues are reported, instance's json just ends like this: "{"status": "pending", "category": "file", "target": "/tmp/cuckoo-tmp-root/tmpZN9QN5/xxxxxxx.pdf", "task_id": 170, "level": "info", "package": "", "asctime": "2020-10-13 12:12:31,460", "custom": "", "time": 1602591151.460462, "action": "task.report", "message": "Starting task reporting", "options": "free=yes,procmemdump=yes"}"

doomedraven commented 4 years ago

Start processing

El mar., 13 oct. 2020 14:50, claudioquincy notifications@github.com escribió:

On Cuckoo 2.0.7 some tasks (very few) are just completed, but not reported. A screenshot from the web GUI: [image: immagine] https://user-images.githubusercontent.com/7129189/95861027-28a7b380-0d61-11eb-9fe4-29b12fa0b0a8.png

I got 2 separated instances on supervisord (40 VMs), and everything runs smooth except for this, sometimes it just miss a report and i can't understand why.

Logs are ok, no issues are reported, instance's json just ends like this: "{"status": "pending", "category": "file", "target": "/tmp/cuckoo-tmp-root/tmpZN9QN5/xxxxxxx.pdf", "task_id": 170, "level": "info", "package": "", "asctime": "2020-10-13 12:12:31,460", "custom": "", "time": 1602591151.460462, "action": "task.report", "message": "Starting task reporting", "options": "free=yes,procmemdump=yes"}"

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/cuckoosandbox/community/issues/482, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAOFH364SJTJ7HXWPXK2CADSKREH7ANCNFSM4SOZQAPQ .

claudioquincy commented 4 years ago

Start processing

What you mean? It's already processing hundreds of other submissions. Thanks.

doomedraven commented 4 years ago

try cuckoo process --help to reprocess them, there is your answer, maybe a bug somewhere

claudioquincy commented 4 years ago

submit to vm != process generated results

As i said there are two instances, currently active and processing results. They just miss SOME result. I just did a cuckoo clean a while ago, next time i'll try and see if reprocessing shows some more info.