Entity case XXXXXXXXXX not found - After deleting case

[FafnerKeyZee]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian GNU/Linux 9.4 (stretch)
OS version (client)
TheHive version / git hash	3.0.8
Package Type	DEB
Browser type & version

Problem Description

After deleting some cases, some tasks are blocked on "running", filters don't work as expected and many entries for missing case are presents into logs.

Steps to Reproduce

Create cases
Close them or not
Delete them
Go to main page (and check for running tasks beside search bar), add play with filters and look the number of tasks increasing.

Complementary information

Extract from logs:
2018-04-10 11:29:33,568 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-406 - Entity case AWFH2PS73lvRzwDjNqZZ not found
2018-04-10 11:29:33,569 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-411 - Entity case AWFHz1W33lvRzwDjNqZG not found
2018-04-10 11:29:33,572 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-410 - Entity case AWFHzEfb3lvRzwDjNqY- not found
2018-04-10 11:29:33,573 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-378 - Entity case AWFHyEt33lvRzwDjNqY1 not found
2018-04-10 11:29:33,573 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-408 - Entity case AWFH0WlM3lvRzwDjNqZJ not found
2018-04-10 11:29:33,574 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-411 - Entity case AWFH1viD3lvRzwDjNqZV not found
2018-04-10 11:29:33,574 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-409 - Entity case AWFHxxaS3lvRzwDjNqYy not found
2018-04-10 11:29:33,575 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-406 - Entity case AWFHwMCb3lvRzwDjNqYn not found
2018-04-10 11:33:00,301 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-417 - Entity case AWFHz1W33lvRzwDjNqZG not found
2018-04-10 11:33:00,301 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-426 - Entity case AWFH2PS73lvRzwDjNqZZ not found
2018-04-10 11:33:00,301 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-417 - Entity case AWFH0WlM3lvRzwDjNqZJ not found
2018-04-10 11:33:00,301 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-430 - Entity case AWFHzEfb3lvRzwDjNqY- not found
2018-04-10 11:33:00,302 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-426 - Entity case AWFH1viD3lvRzwDjNqZV not found
2018-04-10 11:33:00,303 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-417 - Entity case AWFHyEt33lvRzwDjNqY1 not found
2018-04-10 11:33:00,304 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-430 - Entity case AWFHxxaS3lvRzwDjNqYy not found
2018-04-10 11:33:00,304 [WARN] from org.elastic4play.services.AuxSrv in application-akka.actor.default-dispatcher-417 - Entity case AWFHwMCb3lvRzwDjNqYn not found

[To-om]

Hi @FafnerKeyZee,
I can't reproduce the behavior you describe. Can open your browser developer tool (F12) and identify which requests fail (Network tab) ?

[FafnerKeyZee]

Hey,

Sorry for the delay, I've no fail for the requests... Doesn't sound like an network error, but like an internal error ./

[nadouani]

Hello @FafnerKeyZee

How did you delete the cases? By clicking the red "Delete" button in the case details page? or using an API call? Directly from Elasticsearch?

Thanks

[FafnerKeyZee]

Hey,

I removed them by using the red button.

[To-om]

Forget the warning messages "Entity case XXXXXXXXXX not found". In this case, this is not an error. This message was set up before the real deletion was implemented. It is normal that TheHive can't find a deleted case.

I'm interested in last point of "Steps to reproduce". Can you give me more details on "check for running tasks beside search bar" and "look the number of tasks increasing." ? The increase of the number of tasks probably means that some HTTP requests to the back-end never end. Please try to identify them.

[FafnerKeyZee]

Hey, just update to version : 3.0.10-1 from deb repo, bug is fixed.

So we can close this case.

[lliknart]

Hi,

I can reproduce this warning on version TheHive 3.1.1 on Ubuntu 16.04

1. Install Thehive (binary)
2. create a case (web interface)
3. Create a task for this case (web interface)
4. delete Case (with the remove red button)
5. Click on "My tasks" or "Waiting tasks" or "TheHive"

Result:
Oct 11 15:42:12 thehive-test thehive[16469]: [warn] o.e.s.AuxSrv - Entity case AWZjybyHkV8tmqxHX9Ez not found

edit: no need to create a task for this case...
Removing a case from web interface seems to create this warn event with or without attached tasks