Snorby/snorby — Issue #176: Dashboard not incrementing
Author: flan828
Created: 2012-01-09 18:08:06+00:00
State: open

This morning I looked at snorby and found that the counts on the dashboard were all 0. When I looked at the worker part of the interface it said that the worker wasn't running. That it couln't allocate the memory. I was able to restart the worker and the other jobs however the dashboard refuses to increment the counters. I have tried I cleared the cache, restarted the workers, even rebuilt the database from scratch. I cannot get the dashboard to increment the counters. I am at the latest snorby instance. The events are coming in however the Dashboard isnt incrementing.

Not only that, but on the sensor page the count for the sensors are not working either.
I looked in caches and I get the following.

mysql> select * from caches;
+----+------+--------+---------------------+-------------+-----------+-----------+------------+------------------+-------------------+---------+---------+---------------------+---------------------+
| id | sid | cid | ran_at | event_count | tcp_count | udp_count | icmp_count | severity_metrics | signature_metrics | src_ips | dst_ips | created_at | updated_at |
+----+------+--------+---------------------+-------------+-----------+-----------+------------+------------------+-------------------+---------+---------+---------------------+---------------------+
| 1 | 2 | 111671 | 2012-01-09 11:00:00 | 0 | 0 | 0 | 0 | NULL | NULL | NULL | NULL | 2012-01-09 13:00:26 | 2012-01-09 13:00:26 |
+----+------+--------+---------------------+-------------+-----------+-----------+------------+------------------+-------------------+---------+---------+---------------------+---------------------+
1 row in set (0.00 sec)

I know in the past that there was an issue with that NULL value however the post said that it was fixed in the latest release of snorby.

Any help or ideas as to what to do??

Thanks,
Flan