Snorby/snorby — Issue #177: Multiple sensor issue
Author: flan828
Created: 2012-01-12 20:51:29+00:00
State: open

I have multiple sensors that report to the snorby server 2.3.11.
One sensor is working well and I am getting the correct date and time.
The other sensor is two days off I keep getting a date of 1/10/2012 for the events that are coming in.

I have tried the following to rectify the situation
- Checked google for this and found a similar instance where the date was in the future. this is in the past. Plus that bug was fixed two or so versions ago. Having trouble finding events stuck in the past.
- Checked date and time on snorby as well as the offending sensor. they are both correct.
- Dropped the database stopped all snorby worker and jobs. reloaded the database using the rake snorby update env=production. restarted the jobs with just the offending sensor. Still date is off.
- ran snort from command line and verified that the information is coming out as the correct date. and it is.
- looked in the mysql database for the events and the events all have correct dates.
- added the second sensor that was working before and it is still working properly.
- with both sensors in the snorby instance I restarted the worker and all jobs. still no change.
- compared the two configurations of the sensors and both sensors are configured alike.
- rails c --> Time.now reports the correct date and time.
- got the following out of the development.log ( dont know why the development.log is used because I specified earlier that it was supposed to run in production.)
...snip

SQL (0.458ms) SELECT `id`, `priority`, `attempts`, `handler`, `run_at`, `locked_at`, `failed_at` FROM `delayed_jobs` WHERE ((`locked_at` IS NULL OR `locked_at` < '2012-01-12 11:15:03' OR `locked_by` = 'delayed_job host:snorby-deb pid:2617') AND `run_at` <= '2012-01-12 15:15:03' AND `failed_at` IS NULL) ORDER BY `priority`, `run_at` LIMIT 5
SQL (0.804ms) SELECT `id`, `priority`, `attempts`, `handler`, `run_at`, `locked_at`, `failed_at` FROM `delayed_jobs` WHERE ((`locked_at` IS NULL OR `locked_at` < '2012-01-12 11:15:08' OR `locked_by` = 'delayed_job host:snorby-deb pid:2617') AND `run_at` <= '2012-01-12 15:15:08' AND `failed_at` IS NULL) ORDER BY `priority`, `run_at` LIMIT 5
SQL (0.428ms) SELECT `id`, `priority`, `attempts`, `handler`, `run_at`, `locked_at`, `failed_at` FROM `delayed_jobs` WHERE ((`locked_at` IS NULL OR `locked_at` < '2012-01-12 11:15:13' OR `locked_by` = 'delayed_job host:snorby-deb pid:2617') AND `run_at` <= '2012-01-12 15:15:13' AND `failed_at` IS NULL) ORDER BY `priority`, `run_at` LIMIT 5
SQL (0.454ms) SELECT `id`, `priority`, `attempts`, `handler`, `run_at`, `locked_at`, `failed_at` FROM `delayed_jobs` WHERE ((`locked_at` IS NULL OR `locked_at` < '2012-01-12 11:15:18' OR `locked_by` = 'delayed_job host:snorby-deb pid:2617') AND `run_at` <= '2012-01-12 15:15:18' AND `failed_at` IS NULL) ORDER BY `priority`, `run_at` LIMIT 5
SQL (0.420ms) SELECT `id`, `priority`, `attempts`, `handler`, `run_at`, `locked_at`, `failed_at` FROM `delayed_jobs` WHERE ((`locked_at` IS NULL OR `locked_at` < '2012-01-12 11:15:23' OR `locked_by` = 'delayed_job host:snorby-deb pid:2617') AND `run_at` <= '2012-01-12 15:15:23' AND `failed_at` IS NULL) ORDER BY `priority`, `run_at` LIMIT 5
...snip

I am really out of ideas here. If someone could point me in any type of direction for information or a link to a FAQ or something.

Thanks,
Flan