jasonish / evebox

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
https://evebox.org/
MIT License
418 stars 67 forks source link

Failed to commit events (will try again): no such table: events #166

Closed Robs68 closed 3 years ago

Robs68 commented 3 years ago

Hi,

I tried to install Evebox on my PI but I got this error when I launched this command ./evebox server -v -D . --datastore sqlite --input /var/log/suricata/eve.json

My debug prompt : `

2021-04-08 22:51:31 INFO evebox::version: This is EveBox version 0.13.0 (rev: f33d6b5); armv7-unknown-linux-musleabihf 2021-04-08 22:51:31 DEBUG evebox::server::main: Certificate checks disabled: false 2021-04-08 22:51:31 INFO evebox::server::main: Configuration database filename: "./config.sqlite" 2021-04-08 22:51:31 DEBUG evebox::server::main: Checking "/tmp/evebox-0.13.0-linux-arm/b264daf6271f51125d20d5a7715e8947.bookmark" for writability 2021-04-08 22:51:31 INFO evebox::server::main: Using bookmark filename Some("/tmp/evebox-0.13.0-linux-arm/b264daf6271f51125d20d5a7715e8947.bookmark") for input "/var/log/suricata/eve.json" 2021-04-08 22:51:31 INFO evebox::server::main: Starting reader for /var/log/suricata/eve.json 2021-04-08 22:51:31 INFO evebox::server::main: Starting server on 127.0.0.1:5636, tls=false 2021-04-08 22:51:31 WARN evebox::eve::processor: Fail to load bookmark: EOF while parsing a value at line 1 column 0 2021-04-08 22:51:31 DEBUG evebox::sqlite::importer: Commiting 100 events 2021-04-08 22:51:31 ERROR evebox::eve::processor: Failed to commit events (will try again): no such table: events 2021-04-08 22:51:32 DEBUG evebox::sqlite::importer: Commiting 100 events 2021-04-08 22:51:32 ERROR evebox::eve::processor: Failed to commit events (will try again): no such table: events

` It works in EveBox 0.12.

Thanks,

Robs

jasonish commented 3 years ago

I think I have this fixed. Can you try a development build? https://evebox.org/files/development/

I'll release a 0.13.1 a.s.a.p.

jasonish commented 3 years ago

Fixed. Will be released on 0.13.1 real soon.