search

ddbnl / office365-audit-log-collector

Collect / retrieve Office365, AzureAD and DLP audit logs and output to PRTG, Azure Log Analytics Workspace, SQL, Graylog, Fluentd, and/or file output.
https://ddbnl.github.io/office365-audit-log-collector/
MIT License
106 stars 40 forks source link

last_run_times causes process to hang #28

Closed phokur closed 2 years ago

phokur commented 2 years ago

Running on debain

Whenever last_run_times exists in the directory the command runs from, the program will hang at reading the logs.

Ctrl-C gives the following:

Traceback (most recent call last): File "AuditLogCollector.py", line 93, in receive_results_from_rust_engine ValueError: No logs ready

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "AuditLogCollector.py", line 692, in File "AuditLogCollector.py", line 60, in run File "AuditLogCollector.py", line 73, in run_once File "AuditLogCollector.py", line 95, in receive_results_from_rust_engine File "AuditLogCollector.py", line 54, in force_stop File "logging/init.py", line 2082, in info File "logging/init.py", line 1446, in info File "logging/init.py", line 1565, in _log File "AuditLogCollector.py", line 55, in force_stop File "threading.py", line 1006, in join RuntimeError: cannot join thread before it is started [26644] Failed to execute script 'AuditLogCollector' due to unhandled exception!

ddbnl commented 2 years ago

Could you post your config file so I can try to reproduce this? I'll get back to you asap.

In the meantime you could try running without 'resume' but with 'skipKnownContent' as a workaround; that way you wouldn't run into the crash but also avoid duplicates.

ddbnl commented 2 years ago

I have not heard back so I will close this issue. If you need further assistance let me know. As I've mentioned, setting 'resume' to false in the config and 'skipKnownLogs' to true should fix the issue.

I've released a new version in which 'resume' is deprecated and produces a warning in the log file, so people can avoid this issue in the future.