verdx
commented
1 year ago :yellow_circle: Active Response log format
One of the three tests fails with a Timeout error.
```
root@ubuntu22:/home/vagrant/wazuh-qa/tests/system# python3 -m pytest test_active_response_log_format/
=============================================================================================== test session starts ===============================================================================================
platform linux -- Python 3.10.6, pytest-7.1.2, pluggy-1.2.0
rootdir: /home/vagrant/wazuh-qa/tests/system, configfile: pytest.ini
plugins: html-3.1.1, metadata-3.0.0, testinfra-5.0.0
collected 3 items
test_active_response_log_format/test_active_response_log_format.py ..F [100%]
==================================================================================================== FAILURES =====================================================================================================
_________________________________________________________________ test_active_response_log_format[wazuh-agent3-data/messages_425_or_greater.yml] __________________________________________________________________
wazuh_agent = 'wazuh-agent3', message_file = 'data/messages_425_or_greater.yml'
@pytest.mark.parametrize('wazuh_agent, message_file', [('wazuh-agent1', messages_files[0]),
('wazuh-agent2', messages_files[1]),
('wazuh-agent3', messages_files[2])])
def test_active_response_log_format(wazuh_agent, message_file):
"""
description: Check that when an Active Response is activated, the manager sends back the information to the agent
and that it appears in active-response.log and ossec.log with the expected format
wazuh_min_version: 4.2.0
parameters:
- wazuh_agent:
type: string
brief: tells which agent to insert the log message.
- message_file:
type: string
brief: tells HostManager the location of the yml file with the expected messages and where to look for them
input_description: Each agent has a different version with a specific yml file containing the expected messages
and their location in the agent's logs
expected_output: In case the test passes it will show "Received from {host} the expected message: {message}"
in case it failes it will show: "Did not found the expected callback in {host}: {message}"
"""
# Clear the agents files that will be monitored.
enviroment_files = [(wazuh_agent, os.path.join(WAZUH_LOGS_PATH, 'ossec.log')),
(wazuh_agent, os.path.join(WAZUH_LOGS_PATH, 'active-responses.log'))]
clean_environment(host_manager, enviroment_files)
# Add log message to agent monitored source
host_manager.modify_file_content(host=wazuh_agent, path=log_path, content=log_sample)
# wait for active responses messages to be generated
time.sleep(sleep_time)
# Run the callback checks for the ossec.log and the active-responses.log
HostMonitor(inventory_path=inventory_path, messages_path=os.path.join(local_path, message_file),
> tmp_path=tmp_path).run()
test_active_response_log_format/test_active_response_log_format.py:110:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
/usr/local/lib/python3.10/dist-packages/wazuh_testing/tools/monitoring.py:937: in run
self.check_result()
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
self =
def check_result(self):
"""Check if a TimeoutError occurred."""
logger.debug(f'Checking results...')
while not self._queue.empty():
result = self._queue.get(block=True)
for host, msg in result.items():
if isinstance(msg, TimeoutError):
> raise msg
E TimeoutError: Did not found the expected callback in wazuh-agent3: (wazuh-agent3).*('\$token': `132`!)
/usr/local/lib/python3.10/dist-packages/wazuh_testing/tools/monitoring.py:1022: TimeoutError
---------------------------------------------------------------------------------------------- Captured stderr call -----------------------------------------------------------------------------------------------
2023-06-27 16:05:17,045 - wazuh_testing - DEBUG - Add new file composer process for wazuh-agent3 and path: /var/ossec/logs/active-responses.log
2023-06-27 16:05:17,049 - wazuh_testing - DEBUG - Starting file composer for wazuh-agent3 and path: /var/ossec/logs/active-responses.log. Composite file in /home/vagrant/wazuh-qa/tests/system/test_active_response_log_format/tmp/wazuh-agent3_active-responses.log.tmp
2023-06-27 16:05:17,049 - wazuh_testing - DEBUG - Add new file monitor process for wazuh-agent3 and path: /var/ossec/logs/active-responses.log
2023-06-27 16:05:17,052 - wazuh_testing - DEBUG - Add new file composer process for wazuh-agent3 and path: /var/ossec/logs/ossec.log
2023-06-27 16:05:17,055 - wazuh_testing - DEBUG - Add new file monitor process for wazuh-agent3 and path: /var/ossec/logs/ossec.log
2023-06-27 16:05:17,062 - wazuh_testing - DEBUG - Starting QueueMonitor for wazuh-agent3 and message: (wazuh-agent3).*('\$token': `132`!)
2023-06-27 16:05:17,065 - wazuh_testing - DEBUG - Starting QueueMonitor for wazuh-agent3 and message: (wazuh-agent3).*('\$token': `132`!)
2023-06-27 16:05:17,068 - wazuh_testing - DEBUG - Starting file composer for wazuh-agent3 and path: /var/ossec/logs/ossec.log. Composite file in /home/vagrant/wazuh-qa/tests/system/test_active_response_log_format/tmp/wazuh-agent3_ossec.log.tmp
2023-06-27 16:05:56,403 - wazuh_testing - DEBUG - Finishing QueueMonitor for wazuh-agent3 and message: (wazuh-agent3).*('\$token': `132`!)
2023-06-27 16:06:17,092 - wazuh_testing - DEBUG - Finishing QueueMonitor for wazuh-agent3 and message: (wazuh-agent3).*('\$token': `132`!)
2023-06-27 16:06:17,515 - wazuh_testing - DEBUG - Cleaning temporal files...
2023-06-27 16:06:17,517 - wazuh_testing - DEBUG - Checking results...
2023-06-27 16:06:17,519 - wazuh_testing - DEBUG - Received from wazuh-agent3 the expected message: True
------------------------------------------------------------------------------------------------ Captured log call ------------------------------------------------------------------------------------------------
DEBUG wazuh_testing:monitoring.py:921 Add new file composer process for wazuh-agent3 and path: /var/ossec/logs/active-responses.log
DEBUG wazuh_testing:monitoring.py:925 Add new file monitor process for wazuh-agent3 and path: /var/ossec/logs/active-responses.log
DEBUG wazuh_testing:monitoring.py:921 Add new file composer process for wazuh-agent3 and path: /var/ossec/logs/ossec.log
DEBUG wazuh_testing:monitoring.py:925 Add new file monitor process for wazuh-agent3 and path: /var/ossec/logs/ossec.log
DEBUG wazuh_testing:monitoring.py:1028 Cleaning temporal files...
DEBUG wazuh_testing:monitoring.py:1017 Checking results...
DEBUG wazuh_testing:monitoring.py:1023 Received from wazuh-agent3 the expected message: True
============================================================================================= short test summary info =============================================================================================
FAILED test_active_response_log_format/test_active_response_log_format.py::test_active_response_log_format[wazuh-agent3-data/messages_425_or_greater.yml] - TimeoutError: Did not found the expected callback in...
===================================================================================== 1 failed, 2 passed in 185.46s (0:03:05) =====================================================================================
```
juliamagan
QU3B1M
davidjiglesias
Description
This issue aims to analyze and document all about the System test. Jenkins parameters, pytest location, steps in the test and current state of it.
State
Tests done
- https://ci.wazuh.info/job/Test_system/88 - https://ci.wazuh.info/job/Test_system/89 - https://ci.wazuh.info/job/Test_system/90 - https://ci.wazuh.info/job/Test_system/91 - https://ci.wazuh.info/job/Test_system/92 - https://ci.wazuh.info/job/Test_system/93 - https://ci.wazuh.info/job/Test_system/94The pipeline fails with the error:
The failing function is
readJSON, insidegetTestProvisioning, insidesetParameters, in stageInit Environment, in pipelinetest_system.groovy.As the pipeline does not run, manual tests have been done on an Ubuntu 22 machine and the results are in the following comments.
Basically, the results are that all tests pass but sometimes they fail with a timeout error, all errors would probably be fixed if the timeouts are increased.
Possible subtests
The whole test directory structure is explained here (in this comment are shown the
integrationtests, but the structure is the same). Basically, the possible tests to run are the directories inside the directorytests/systemin https://github.com/wazuh/wazuh-qa. The test you want to run is defined in parameterTEST_PATH. They are the following:All possible tests
``` ├── test_active_response │ ├── test_analysisd │ └── test_execd ├── test_agentd ├── test_analysisd │ ├── test_all_syscheckd_configurations │ │ └── yaml_generators │ ├── test_error_messages │ ├── test_event_messages │ ├── test_integrity_messages │ ├── test_limit_eps │ ├── test_mitre │ ├── test_predecoder_stage │ ├── test_queue_socket_properties │ ├── test_scan_messages │ ├── test_signature_id │ └── test_syscollector ├── test_api │ ├── test_config │ │ ├── test_bruteforce_blocking_system │ │ ├── test_cache │ │ ├── test_cors │ │ ├── test_DOS_blocking_system │ │ ├── test_drop_privileges │ │ ├── test_experimental_features │ │ ├── test_host_port │ │ ├── test_https │ │ ├── test_jwt_token_exp_timeout │ │ ├── test_logs │ │ ├── test_max_upload_size │ │ ├── test_rbac │ │ └── test_request_timeout │ ├── test_middlewares │ ├── test_rbac │ └── test_statistics ├── test_authd │ ├── files │ └── force_options ├── test_enrollment ├── test_fim │ ├── test_files │ │ ├── test_ambiguous_confs │ │ ├── test_audit │ │ ├── test_basic_usage │ │ ├── test_env_variables │ │ ├── test_file_limit │ │ ├── test_follow_symbolic_link │ │ ├── test_ignore │ │ ├── test_inotify │ │ ├── test_max_eps │ │ ├── test_moving_files │ │ ├── test_prefilter_cmd │ │ ├── test_process_priority │ │ ├── test_recursion_level │ │ ├── test_report_changes │ │ ├── test_restrict │ │ ├── test_scan │ │ ├── test_skip │ │ ├── test_tags │ │ ├── test_timezone_changes │ │ └── test_windows_audit_interval │ ├── test_registry │ │ ├── test_registry_ambiguous_confs │ │ ├── test_registry_basic_usage │ │ ├── test_registry_checks │ │ ├── test_registry_file_limit │ │ ├── test_registry_ignore │ │ ├── test_registry_multiple_registries │ │ ├── test_registry_nodiff │ │ ├── test_registry_report_changes │ │ │ └── test_disk_quota │ │ ├── test_registry_restrict │ │ └── test_registry_tags │ └── test_synchronization ├── test_gcloud │ ├── test_configuration │ └── test_functionality ├── test_github │ └── test_configuration ├── test_integratord ├── test_logcollector │ ├── test_age │ ├── test_command_monitoring │ ├── test_configuration │ ├── test_keep_running │ ├── test_localfile │ ├── test_location │ ├── test_location_custom_sockets │ ├── test_log_format │ ├── test_macos │ ├── test_only_future_events │ ├── test_options │ ├── test_reconnect_time │ └── test_statistics ├── test_logtest │ ├── test_configuration │ ├── test_invalid_rule_decoders_syntax │ ├── test_invalid_socket_input │ ├── test_invalid_token │ ├── test_log_process_options │ ├── test_remove_old_sessions │ ├── test_remove_session │ ├── test_rules_decoders_load │ └── test_ruleset_refresh ├── test_office365 │ └── test_configuration ├── test_remoted │ ├── test_active_response │ ├── test_agent_communication │ ├── test_configuration │ ├── test_manager_messages │ ├── test_multi_groups │ └── test_socket_communication ├── test_rids ├── test_rootcheck ├── test_syscollector ├── test_vulnerability_detector │ ├── test_cpe_helper │ ├── test_feeds │ ├── test_general_settings │ ├── test_providers │ ├── test_scan_results │ ├── test_scan_types │ └── test_vulnerability_inventory ├── test_wazuh_db └── test_wpk ```Parameters
wazuh-jenkinsrepository's commit or branch/tag.wazuh-qarepository's commit or branch/tag.pytestexecution. Default-v --tb=short.Local execution
This test suite can be executed locally as well, to do so, you have to follow these steps:
wazuh-qarepositorywazuh-testinglibrary