Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] Cuckoo Analyzer Fails when it hasn't been executed for many hours #437

Closed
nicpenning opened this issue Mar 8, 2019 · 1 comment
Closed
Labels
category:invalid Issue is related to an invalid request scope:analyzer Issue is analyzer related
Milestone

Comments

@nicpenning
Copy link
Contributor

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
Steps to reproduce the behavior:

  1. Run Cuckoo Cortex Analyzer against a URL
  2. Receive error
  3. Run Cuckoo Cortex Analyzer again - it works

Expected behavior
The analyzer should not fail on first run.

Complementary information
This error is received when running the analyzer after it hasn't been used in many hours (about 8-12 hours):
Unexpected Error: Expecting value: line 1 column 1 (char 0)

However, the next run everything just works.

Running 3.3.0-RC5 TheHive (This also occurred on the latest stable release) and
Cortex2.1.3-1
Elastic4Play1.7.2
Play2.6.20
Elastic4s5.6.6
ElasticSearch client 5.6.9
ElasticSearch cluster 5.6.15

But it only seems to happen the once and for the first time when it is a new day. I have not been able to have this issue occur repeatedly outside of the first time trying to run it every morning.

image

After the failure it works great for the remainder of the day.

Work environment

  • Client OS: Win10
  • Server OS: Ubuntu 18.04
  • Browse type and version: Chrome
  • Cortex version:
  • Cortex Analyzer/Responder name:
  • Cortex Analyzer/Responder version:
@nicpenning nicpenning added the category:bug Issue is related to a bug label Mar 8, 2019
@jeromeleonard jeromeleonard added this to the 2.5.0 milestone Jan 20, 2020
@nicpenning
Copy link
Contributor Author

Update - This appears to be a configuration issue with MySQL on the Cuckoo side, not the analyzer.

The analyzer works great when increasing the default MySQL time out period from 8 hours to something much higher, such as a month.

If you don't use the MySQL back-end for Cuckoo you may not see this problem.

You can check it out how to change it here: https://support.rackspace.com/how-to/how-to-change-the-mysql-timeout-on-a-server/

We have tested this by decreasing the timeout and noticing that the same error existed in a shorter period of time. Based on this testing, we are confident this will resolve the issue at hand.

@jeromeleonard jeromeleonard added category:invalid Issue is related to an invalid request scope:analyzer Issue is analyzer related and removed category:bug Issue is related to a bug labels Feb 14, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
category:invalid Issue is related to an invalid request scope:analyzer Issue is analyzer related
Projects
None yet
Development

No branches or pull requests

2 participants