Open ghost opened 5 years ago
Hey bitback,
Thanks for posting an issue.
Obviously that is not supposed to happen. I will look into this. Can you please share the full cuckoo.log from $CWD/logs/cuckoo.log
via pastebin link?
Could you also share your machinery and cuckoo config files?
Hey @RicoVZ ,
Thanks for your quick response.
Following the pastebin links: https://pastebin.com/eca8U02s -> cuckoo.conf https://pastebin.com/dkurzsUX -> kvm.conf https://pastebin.com/5uiXeRJ1 -> cuckoo.log https://pastebin.com/L4CqatZm -> process-instance1.json
FYI: #1 - #30 are executables where Cuckoo decided itself which analysis system will be used (looks pretty good). For #31 - #40 the 32 bit system has been selected via API (here the error occurs).
Thanks for posting those. :slightly_smiling_face:
I suspect this is some issue with the database causing the machine to not lock properly.
Can you run Cuckoo again with these tasks, but with the --debug
flag? After that, please post the full log file again.
cuckoo --debug
Here's the debugging log: https://pastebin.com/Z5s4REWt
@RicoVZ any updates on this?
Sorry @bitback I lost the log, and the paste seems to have been removed.
Can you share the log again?
Compare #3105, are those the same conditions?
Seems so:
019-06-25 13:02:26,122 [cuckoo.core.scheduler] INFO: Task #113: acquired machine win7-32 (label=win7-32)
2019-06-25` 13:02:26,122 [cuckoo.core.scheduler] INFO: Task #105: acquired machine win7-32 (label=win7-32)
Compare #3105, are those the same conditions?
Seems so:
019-06-25 13:02:26,122 [cuckoo.core.scheduler] INFO: Task #113: acquired machine win7-32 (label=win7-32)
2019-06-25` 13:02:26,122 [cuckoo.core.scheduler] INFO: Task #105: acquired machine win7-32 (label=win7-32)
Thanks for creating an issue! But first: did you read our community guidelines? https://cuckoo.sh/docs/introduction/community.html
My issue is:
On the current setup I use 4 analysis VMs running on KVM. When submitting files using the API or web interface and let Cuckoo automatically decide which system should be used for the analysis, everything works like a charm.
But when submitting e.g. 10 files to a specific analysis system (using the API), Cuckoo tries to start all analysis as the same time which end up in curious errors. Only a few of them are processed successfully, all the others end up in errors.
Also, the running counter on the website shows, that all 10 analysis are running at the same time.
Cuckoo is up to date and also, agent.py has been updated on the analysis VM to version 0.10. As mentioned above, when Cuckoo itself will decide which analysis system will be chosen, submitting 100 files works fine.
My Cuckoo version and operating system are:
Operating system: Ubuntu 18.04 (Kernel version: 4.15.0-52-generic x86_64 GNU/Linux)
Cuckoo version: 2.0.7
This can be reproduced by:
Using multiple analyzer VMs (at least two) and submit e.g. 10 files to the analyzer and specify cuckoo_vm_1 as analyzer machine.
In the logs below, analysis #104 - #113 have been submitted at the same time an win7-32 (one of 4 VM's) has been chosen as analysis system.
104, #106, #109, #110 - ending successful
105, #107, #108, #111, #112, #113 ending up in errors.
The log, error, files etc can be found at:
cuckoo.log