Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[splunk] Connection errors are not logged #2374

Closed
gileri opened this issue Jul 18, 2024 · 2 comments · Fixed by #2381
Closed

[splunk] Connection errors are not logged #2374

gileri opened this issue Jul 18, 2024 · 2 comments · Fixed by #2381
Assignees
Labels
bug use for describing something not working as expected filigran team use to identify PR from the Filigran team solved use to identify issue that has been solved (must be linked to the solving PR)
Milestone

Comments

@gileri
Copy link
Member

gileri commented Jul 18, 2024

Description

Critical errors seem to not be logged in the splunk connector. For example, network connection errors lead to the process termination without any logs except the standard "Terminated" message

2024-07-18 15:46:45.174	Terminated
2024-07-18 15:39:33.046	Terminated
2024-07-18 15:32:14.774	Terminated
2024-07-18 15:24:56.502	Terminated

Environment

  1. OS (where OpenCTI server runs): Official docker image.
  2. OpenCTI version: 6.2.5
  3. OpenCTI client:
  4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Use an source IP address on your host that is blocked by the remote splunk instance
  2. Use connector

Expected Output

An error or exception in logs.

Actual Output

No logs, just a Terminated message.

Additional information

I believe other errors may also not be logged, but haven't investigated further.

Screenshots (optional)

@gileri gileri added bug use for describing something not working as expected needs triage use to identify issue needing triage from Filigran Product team labels Jul 18, 2024
@nino-filigran
Copy link

@helene-nguyen & @Megafredo Could you have a look at this please 🙏 ?

@helene-nguyen
Copy link
Member

@nino-filigran Yes, sure!

@helene-nguyen helene-nguyen self-assigned this Jul 22, 2024
@helene-nguyen helene-nguyen removed the needs triage use to identify issue needing triage from Filigran Product team label Jul 22, 2024
@helene-nguyen helene-nguyen added this to the Release 6.3.0 milestone Jul 22, 2024
@helene-nguyen helene-nguyen linked a pull request Jul 22, 2024 that will close this issue
4 tasks
@helene-nguyen helene-nguyen added the solved use to identify issue that has been solved (must be linked to the solving PR) label Jul 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug use for describing something not working as expected filigran team use to identify PR from the Filigran team solved use to identify issue that has been solved (must be linked to the solving PR)
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants