sipcapture / homer

HOMER - 100% Open-Source SIP, VoIP, RTC Packet Capture & Monitoring
https://sipcapture.org
GNU Affero General Public License v3.0
1.61k stars 240 forks source link

Date filtering not retrieving correct records #660

Closed iaindooley closed 2 weeks ago

iaindooley commented 2 weeks ago

Hi there,

I'm using Homer 7 and capturing data file, using heplify + freeswitch + fusionpbx. Everything appears to be fine in terms of the mechanics of it: data coming in, being displayed, searchable etc.

However, the date range is returning incorrect results, here's what I can see:

1) Last 5 minutes - Last 30 minutes: correct. The most recent record stays the same, and the oldest record goes back 5 - 30 minutes

2) Last 1 hour: the most recent record is slightly off, it's about 3 minutes older than the most recent record shown above

3) Last 3 hours: the most recent record is about 2 hours earlier than the most recent records above

4) Last 6 hours: the most recent record is about 5 hours earlier than the most recent records above

5) Last 12 hours: the most recent record is about 11 hours earlier than the most recent records above

6) Last 24 hours: the most recent record is about 23 hours earlier than the most recent records above

In all the cases above, the oldest record is correct, meaning that the last 24 hours shows 1 hour of records, starting 24 hours ago and ending 23 hours ago and so on.

7) Today shows the first hour of today, ie. from about 00:00 to about 01:00 on 28 August

8) Yesterday does the same, but for 27 August

9) Last 7 days, the most recent record is 4 days ago, and so is the earliest record, but that's because I set it up 4 days ago

As such, last 7 days, 14 days and this month are all the same results, last month shows nothing.

If I do a custom range from 00:00 on 26 August to 23:59:59 on 28 August, I see the most recent record as 26 August 09:38 but there are more recent records than that, which I see by using for example the "last 5 minutes" option, so it appears that the custom date range also doesn't allow me to see a continuous range of data within the correct boundaries.

One thing to note is that, when first set up, the server on which Homer is running was in a different timezone to the 2 servers sending captured SIP data, which I fixed 2 days ago, so the most recent data shouldn't have any issues due to timezone differences.

However, one thing I thought might be a problem is that the servers are in AEST (Sydney local time), do they need to be set to UTC and the timezone configured in the Homer settings?

Thanks! Iain

github-actions[bot] commented 2 weeks ago

Please star this repository to motivate the developers and to get higher priority! :star:

lmangani commented 2 weeks ago

Hello @iaindooley At first glance you're running into the default LIMIT which crops the results no matter what the span is. Could you try repeating the exercise and settings the LIMIT to a higher number progressively? I cannot suggest one having no idea how much data you're ingesting.

iaindooley commented 2 weeks ago

@lmangani thanks for the speedy reply. I looked in the web interface and in the web app config file, and the install documentation and I can't find anything about a limit. Can you tell me how I change that please?

lmangani commented 2 weeks ago

I'm using Homer 7

There's no special documentation, LIMIT is just one of the many fields you can add to your search form

iaindooley commented 2 weeks ago

Nailed it thanks, I put the limit in as 1,000,000 and searched the past 2 days and everything is correct! I see about 15,000 records.