idaholab / Malcolm

Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
https://idaholab.github.io/Malcolm/
Other
359 stars 59 forks source link

Bug: After uploading a pcap file, the dashboard and Arkime cannot function properly #545

Closed pigcanfly432 closed 1 month ago

pigcanfly432 commented 2 months ago

Describe the bug Malcolm was originally working fine. After running ./scripts/wipe ,restarting Malcolm, and uploading a pcap file, both the dashboard and Arkime are not functioning correctly. The error reports are as follows:

Displays the error message "Internal server error" Screenshot from 2024-08-21 14-24-16

Displays the error message {"success":false,"text":"User not found"} Screenshot from 2024-08-21 14-34-56

To Reproduce Steps to reproduce the behavior:

  1. ./scripts/wipe
  2. ./scripts/start
  3. upload the pacp file
  4. click dashboards or arkime
  5. See error

Expected behavior A clear and concise description of what you expected to happen.

The dashboard and Arkime should display their content normally.

Malcolm Version: [Malcolm v24.07.0]

How are you running Malcolm? The installation was performed according to the official documentation. ubuntu 22.04

Additional context

device info

Memory is allocated for OpenSearch and Logstash as follows: memory is allocated for opensearch and logstash

doris@doris:~/Malcolm$ grep JAVA_OPTS config/*.env config/logstash.env:LS_JAVA_OPTS=-server -Xmx2500m -Xms2500m -Xss1536k -XX:-HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/./urandom -Dlog4j.formatMsgNoLookups=true config/opensearch.env:OPENSEARCH_JAVA_OPTS=-server -Xmx10g -Xms10g -Xss256k -XX:-HeapDumpOnOutOfMemoryError -Djava.security.egd=file:/dev/./urandom -Dlog4j.formatMsgNoLookups=true

mmguero commented 2 months ago

I've just released Malcolm v24.08.0 and I cannot reproduce this problem, but I couldn't reproduce it in v24.07.0. Is there anything in the output of ./scripts/logs when you get the internal server error that could help us narrow it down?

mmguero commented 1 month ago

No response from OP, closing.