search

jasonish / evebox

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
https://evebox.org/
MIT License
418 stars 67 forks source link

EveBox may start before Elasticsearch is ready when started from systemd #170

Closed fcorneli closed 3 years ago

fcorneli commented 3 years ago

Running Evebox as systemd service on CentOS, with elasticsearch as database, gives me an error that elasticsearch is not available upon system reboot and hence the Evebox service fails to start. Adding to /usr/lib/systemd/system/evebox.service the following line under [Unit] solves the issue:

After=elasticsearch.service

Maybe this could be included per default?

jasonish commented 3 years ago

Not all systemd users of EveBox are using Elasticsearch. I'll have to tune the waiting for elasticsearch to become available behaviour.

fcorneli commented 3 years ago

Not all systemd users of EveBox are using Elasticsearch.

That's why I used After instead of Requires. Hence if Elasticsearch runs on the machine, Evebox will be started after Elasticsearch (just in case Evebox actually uses Elasticsearch as data source). If Elasticsearch does not run on the machine, Evebox will also be started and After is simply not used by systemd.

But indeed, ideally Evebox can survive the fact that Elasticsearch is started after it.

jasonish commented 3 years ago

EveBox will now wait on startup for Elasticsearch to be ready. This was needed even outside of systemd. This is now in development builds. I plan a release build soon I think.