telekom-security / tpotce

🍯 T-Pot - The All In One Multi Honeypot Platform 🐝
GNU General Public License v3.0
6.82k stars 1.08k forks source link

T-POT stopped adding data to elastic search #279

Closed hvdkooij closed 5 years ago

hvdkooij commented 5 years ago

I installed T-POT 18.11 on December the 7th and it is still running but as of 2 days ago nothing gets added to the elasticsearch database.

NAME STATUS PORTS adbhoney Up 12 minutes 0.0.0.0:5555->5555/tcp ciscoasa Up 13 minutes conpot_guardian_ast Up 13 minutes 0.0.0.0:10001->10001/tcp conpot_iec104 Up 13 minutes 0.0.0.0:161->161/tcp, 0.0.0.0:2404->2404/tcp conpot_ipmi Up 13 minutes 0.0.0.0:623->623/tcp conpot_kamstrup_382 Up 12 minutes 0.0.0.0:1025->1025/tcp, 0.0.0.0:50100->50100/tcp cowrie Up 12 minutes 0.0.0.0:22-23->22-23/tcp cyberchef Up 12 minutes (healthy) 127.0.0.1:64299->8000/tcp dionaea Up 12 minutes elasticpot Up 12 minutes 0.0.0.0:9200->9200/tcp elasticsearch Up 13 minutes (healthy) 127.0.0.1:64298->9200/tcp ewsposter Up 12 minutes glutton Up 12 minutes head Up 11 minutes (healthy) 127.0.0.1:64302->9100/tcp heralding Up 13 minutes 0.0.0.0:110->110/tcp, 0.0.0.0:143->143/tcp, 0.0.0.0:993->993/tcp, 0.0.0.0:995->995/tcp, 0.0.0.0:5432->5432/tcp, 0.0.0.0:5900->5900/tcp kibana Up 11 minutes (healthy) 127.0.0.1:64296->5601/tcp logstash Up 11 minutes (healthy) mailoney Up 13 minutes 0.0.0.0:25->25/tcp medpot Up 12 minutes 0.0.0.0:2575->2575/tcp nginx Up 13 minutes p0f Up 12 minutes rdpy Up 12 minutes 0.0.0.0:3389->3389/tcp snare Up 12 minutes 0.0.0.0:80->80/tcp spiderfoot Up 13 minutes (healthy) 127.0.0.1:64303->8080/tcp suricata Up 13 minutes tanner Up 12 minutes tanner_api Up 12 minutes tanner_phpox Up 12 minutes tanner_redis Up 13 minutes 6379/tcp tanner_web Up 12 minutes

hvdkooij commented 5 years ago

I just noticed these warnings of the update process:

/usr/local/bin/multielasticdump -> /usr/local/lib/node_modules/elasticdump/bin/multielasticdump /usr/local/lib └── elasticdump@4.1.2 (git+https://github.com/taskrabbit/elasticsearch-dump.git#146ba59f8de3ccdc1c7a68ca8f7e591fc8801297)

The directory '/home/tsec/.cache/pip/http' or its parent directory is not owned by the current user and the cache has been disabled. Please check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag. The directory '/home/tsec/.cache/pip' or its parent directory is not owned by the current user and caching wheels has been disabled. check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag. Requirement already up-to-date: pip in /usr/local/lib/python2.7/dist-packages (18.1) The directory '/home/tsec/.cache/pip/http' or its parent directory is not owned by the current user and the cache has been disabled. Please check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag. The directory '/home/tsec/.cache/pip' or its parent directory is not owned by the current user and caching wheels has been disabled. check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag. Requirement already up-to-date: elasticsearch-curator in /usr/local/lib/python2.7/dist-packages (5.6.0)

Not sure if it is relevant.

hvdkooij commented 5 years ago

It seemed to resolve itself after I did the following steps.

  1. Find and remove all log files over 10 days old.
  2. Restart the unit.
  3. Wait for an hour.