Snorby/snorby — Issue #178: 500 error on any page with alert's details
Author: mikevmk
Created: 2012-01-22 19:41:13+00:00
State: open

Hello!
I receive "We're sorry..." on any try to view some details on alert(s). It seems to be GeoIP related problem.

What is in production.log:
----
Started GET "/results?search%5Bsignature_name%5D=%28http_inspect%29+OVERSIZE+REQUEST-URI+DIRECTORY&title=%28http_inspect%29+OVERSIZE+REQUEST-URI+D..." for X.X.X.X at Sun Jan 22 11:30:12 -0800 2012
Processing by PageController#results as HTML
Parameters: {"title"=>"(http_inspect) OVERSIZE REQUEST-URI D...", "search"=>{"signature_name"=>"(http_inspect) OVERSIZE REQUEST-URI DIRECTORY"}}
Rendered events/_menu.html.erb (6.3ms)
Rendered events/_menu.html.erb (1.3ms)
Rendered events/_event.html.erb (12.9ms)
Rendered page/_events.html.erb (17.9ms)
Rendered page/results.html.erb within layouts/application (28.1ms)
Completed 500 Internal Server Error in 34ms

ActionView::Template::Error (can't convert File into String):
21:

22: <% if geoip? && event.ip.present? %>
23:
24: <% geoip_src = event.ip.geoip[:source] %>
25:
26: <%= geoip_src[:country_code2] %>
27:
lib/snorby/geoip.rb:34:in `new'
lib/snorby/geoip.rb:34:in `lookup'
app/models/ip.rb:60:in `geoip'
app/views/events/_event.html.erb:24:in `_app_views_events__event_html_erb___72653728_70011660846780'
app/views/page/_events.html.erb:48:in `_app_views_page__events_html_erb___1380687601_70011663834000'
app/views/page/_events.html.erb:3:in `_app_views_page__events_html_erb___1380687601_70011663834000'
app/views/page/results.html.erb:17:in `_app_views_page_results_html_erb___2038222895_70011664272820'
----

I'm using nginx 1.1.11 + passenger 3.0.11
ruby 1.8.7 (2011-06-30 patchlevel 352) [x86_64-linux]
geoip-1.1.1 (under vendor/cache/... directory)