dkindlund / honeyclient

MITRE HoneyClient Project
http://www.honeyclient.org
GNU General Public License v2.0
8 stars 4 forks source link

cannot snapshot #211

Open dkindlund opened 14 years ago

dkindlund commented 14 years ago

after i started the honeyclient,it's ok to work. But when the check failed,it has problem to take another clone. the output below:

WARNING: VM HAS BEEN COMPROMISED! 2009-03-09 14:34:29 WARN HoneyClient::Manager::runSession - VM Compromised. Last Resource (http://www.pdaxyz.com/) 2009-03-09 14:34:29 INFO HoneyClient::Manager::runSession - Saving fingerprint to 'fingerprint.dump'. 2009-03-09 14:34:29 INFO HoneyClient::Manager::runSession - Archiving VM... 2009-03-09 14:34:57 INFO HoneyClient::Manager::VM::snapshotVM - Snapshotting VM (/vm/clones/1ac3a72356839546b12d6fdf0c/master.vmx) to (/vm/snapshots/1ac3a72356839546b12d6fdf0c-20090309T143456.tar.gz). Starting new session... 2009-03-09 14:35:00 INFO HoneyClient::Manager::VM::Clone::new - Setting VM (/vm/master/master.vmx) as master. 2009-03-09 14:35:15 INFO HoneyClient::Manager::VM::Clone::_init - Quick cloning master VM (/vm/master/master.vmx). /bin/tar: 1ac3a72356839546b12d6fdf0c/master.vmem: file changed as we read it 2009-03-09 14:35:54 WARN HoneyClient::Manager::VM::ANON - Could not snapshot VM to (/vm/snapshots/1ac3a72356839546b12d6fdf0c-20090309T143456.tar.gz). (256: ) 2009-03-09 14:35:56 ERROR HoneyClient::Util::SOAP::_handleFault - Error occurred during processing. HoneyClient::Manager::VM->snapshotVM(): Could not snapshot VM to (/vm/snapshots/1ac3a72356839546b12d6fdf0c-20090309T143456.tar.gz). HoneyClient::Manager::VM->snapshotVM(): {'err' => bless( {'errNo' => '256','errStr' => ''}, 'err' )} HoneyClient::Util::SOAP->handleFault(): Error occurred during processing. HoneyClient::Manager::VM->snapshotVM(): Could not snapshot VM to (/vm/snapshots/1ac3a72356839546b12d6fdf0c-20090309T143456.tar.gz). HoneyClient::Manager::VM->snapshotVM(): {'err' => bless( {'errNo' => '256','errStr' => ''}, 'err' )} 2009-03-09 14:35:56 INFO HoneyClient::Manager::VM::Clone::DESTROY - Suspending clone VM (/vm/clones/d77d65065ab5040c5aa129f848/master.vmx). Killed

dkindlund commented 14 years ago

Author: Anothernymous aptarus@gmail.com Does anyone know what to do with that problem ? I apparently encountered the same (tar.gz not created because of files being seemingly modificated). I can add that the clone was STILL registered in VMware Server (1.x, latest version to date) - but it's not directly a VMWare-related issue as at the creation the Clone is successfully appearing/disappearing/reappearing from the VM list, and manual unregister is OK.

It seems like it causes the Manager to stop, but I can't say if it is systematic (it didn't happened often enough).

dkindlund commented 14 years ago

Author: kindlund Anonymous: There is a problem with your master.vmx configuration; see this ticket for more information:

http://www.honeyclient.org/trac/ticket/148#comment:9

Specifically, your master.vmx should only have this as the ide0:0.mode: {{{ ide0:0.mode = "persistent" }}}