[Bug] Reload last case number from database periodically

[To-om]

Request Type

Bug

Problem Description

In certain circumstances, the latest case number kept by the actor and the value in the database are not sync. The aim of this issue is to reload the latest case number from database periodically.
The time between two database reads is configured with caseNumber.reload.interval (default is 10 minutes).

[Keroseno101]

Hi @To-om, I think this is related with one Issue that I have since 2 weeks.

In my platform we have already more than 9000 Cases, before the reboot the case number was 91XX, but after the reboot the cases start to be numbers like 30XX, 64XX... everything a mess. Cases already created with a Case Number have now other Case number.

I am planning a drop and rebuild from Index, because I think that has nothing to do with Database but I am not sure.

Do you have some advice?

[realAnimoL]

Bump because the issue still persists @To-om on version 4.1.19-1. Same behavior as explained by @Keroseno101 after restarting TheHive.

[Keroseno101]

@realAnimoL did you try to rebuild index? You can add this line at the end of /etc/thehive/application.conf
db.janusgraph.dropAndRebuildIndexOnFailure: true
(deactivate after use one time)
And then restart thehive and check the logs to see if everything is OK.

After that Elasticsearch should rebuild index with the right information in database, that means, all the mess will be fixed and no data will be deleted.

Sadly our problem is not related with the post because is just a sync problem between Elasticsearch and cassandra after a upgrade/update/reboot.

Let me know if that works for you, at least can others read it. I didn't know more people with this mess case number problem.