Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Infinite loop during the pagination of search results #226

Open
AlexRuiz7 opened this issue Jan 16, 2025 · 4 comments
Open

[BUG] Infinite loop during the pagination of search results #226

AlexRuiz7 opened this issue Jan 16, 2025 · 4 comments
Assignees
Labels
level/task Task issue type/bug Bug issue

Comments

@AlexRuiz7
Copy link
Member

AlexRuiz7 commented Jan 16, 2025

Describe the bug
During the testing of #180, it was detected a bug on the Command Manager where the code to paginate the search results enters an infinite loop.

[2025-01-14T14:01:20,670][WARN ][c.w.c.j.SearchThread     ] [node-1] Empty hits page, not getting searchAfter values

To Reproduce
Steps to reproduce the behavior:

  1. By default, the page length is set to 100. The issue is reproducible by simply indexer >100 commands before the search job is run.

Expected behavior

  • Pagination works properly.
  • The Command Manager does not enter an infinite loop.

Plugins
Command Manager.

Additional context

#213 (review)

@AlexRuiz7 AlexRuiz7 added level/task Task issue type/bug Bug issue labels Jan 16, 2025
@AlexRuiz7 AlexRuiz7 added level/subtask Subtask issue and removed level/task Task issue labels Jan 16, 2025
@wazuhci wazuhci moved this to Triage in XDR+SIEM/Release 5.0.0 Jan 16, 2025
@AlexRuiz7 AlexRuiz7 added level/task Task issue and removed level/subtask Subtask issue labels Jan 16, 2025
@wazuhci wazuhci moved this from Triage to Backlog in XDR+SIEM/Release 5.0.0 Jan 16, 2025
@AlexRuiz7 AlexRuiz7 self-assigned this Jan 21, 2025
@wazuhci wazuhci moved this from Backlog to In progress in XDR+SIEM/Release 5.0.0 Jan 21, 2025
@AlexRuiz7 AlexRuiz7 removed their assignment Jan 21, 2025
@wazuhci wazuhci moved this from In progress to Backlog in XDR+SIEM/Release 5.0.0 Jan 21, 2025
@f-galland f-galland self-assigned this Jan 22, 2025
@f-galland
Copy link
Member

The bug is triggered even after setting the page size to 2 and indexing more than 2 commands.

@wazuhci wazuhci moved this from Backlog to In progress in XDR+SIEM/Release 5.0.0 Jan 22, 2025
@f-galland
Copy link
Member

Strangely enough, I'm not able to replicate the issue when running the plugin with a breakpoint within SearchThread.run()

@f-galland
Copy link
Member

f-galland commented Jan 22, 2025

I was actually able to trigger the bug while running the debugger and noticed the PointInTimeBuilder object changes its reference ID from iteration to iteration.

I think even though the debugger is paused, the timeout of the PIT is still running in the background, and the PIT is regenerated.

@f-galland
Copy link
Member

Another interesting bit here is that I see a message from the debugger saying 2 other threads also reached breakpoints, and I've only placed a breakpoint within SearchThread.run(), which should be run in a single thread.

Image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
level/task Task issue type/bug Bug issue
Projects
Status: In progress
Development

No branches or pull requests

2 participants