Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unexpected Shutdown & List 'name' has 0 rules #3468

Closed
HNJBB opened this issue Feb 28, 2020 · 5 comments
Closed

Unexpected Shutdown & List 'name' has 0 rules #3468

HNJBB opened this issue Feb 28, 2020 · 5 comments
Assignees
@emanuele-f
Labels
In Progress Low-Priority Bug

Comments

@HNJBB
Copy link

HNJBB commented Feb 28, 2020

Feb 28 00:00:05 ntop ntopng[1722]: 28/Feb/2020 00:00:05 [MySQLDB.cpp:824] Attempting to connect to MySQL for interface tcp://127.0.0.1:5556...
Feb 28 00:00:05 ntop ntopng[1722]: 28/Feb/2020 00:00:05 [MySQLDB.cpp:850] Successfully connected to MySQL [root@localhost:3306] for interface tcp://127.0.0.1:5556
Feb 28 00:00:26 ntop ntopng[1722]: 28/Feb/2020 00:00:26 [main.cpp:50] Shutting down...
Feb 28 00:00:26 ntop systemd[1]: Stopping ntopng high-speed web-based traffic monitoring and analysis tool...
Feb 28 00:00:28 ntop ntopng[1722]: 28/Feb/2020 00:00:28 [Ntop.cpp:2370] Terminating periodic activities
Feb 28 00:00:50 ntop ntopng[1722]: [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'Cisco Talos Intelligence' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: 28/Feb/2020 00:00:50 [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'Cisco Talos Intelligence' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'Emerging Threats' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: 28/Feb/2020 00:00:50 [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'Emerging Threats' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'Feodo Tracker Botnet C2 IP Blocklist' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: 28/Feb/2020 00:00:50 [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'Feodo Tracker Botnet C2 IP Blocklist' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'NoCoin Filter List' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: 28/Feb/2020 00:00:50 [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'NoCoin Filter List' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'SSLBL Botnet C2 IP Blacklist' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: 28/Feb/2020 00:00:50 [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'SSLBL Botnet C2 IP Blacklist' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'SSLBL JA3' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: 28/Feb/2020 00:00:50 [housekeeping.lua:32] [lists_utils.lua:584] WARNING: List 'SSLBL JA3' has 0 rules. Please report this to https://github.com/ntop/ntopng
Feb 28 00:00:50 ntop ntopng[1722]: 28/Feb/2020 00:00:50 [Ntop.cpp:2376] Executing shutdown script
Feb 28 00:00:51 ntop ntopng[1722]: 28/Feb/2020 00:00:51 [ProtoStats.cpp:35] [IPv4] 37.11 TB/48102.64 M Packets
Feb 28 00:00:51 ntop ntopng[1722]: 28/Feb/2020 00:00:51 [ProtoStats.cpp:35] [IPv6] 0 B/0.00 Packets
Feb 28 00:00:51 ntop ntopng[1722]: 28/Feb/2020 00:00:51 [ProtoStats.cpp:35] [ARP] 0 B/0.00 Packets
Feb 28 00:00:51 ntop ntopng[1722]: 28/Feb/2020 00:00:51 [ProtoStats.cpp:35] [MPLS] 0 B/0.00 Packets
Feb 28 00:00:51 ntop ntopng[1722]: 28/Feb/2020 00:00:51 [ProtoStats.cpp:35] [Other] 0 B/0.00 Packets
Feb 28 00:00:51 ntop ntopng[1722]: 28/Feb/2020 00:00:51 [Ntop.cpp:2359] Polling shut down [interface: tcp://127.0.0.1:5556]
Feb 28 00:00:51 ntop ntopng[1722]: 28/Feb/2020 00:00:51 [Ntop.cpp:2393] Deleted PID /var/run/ntopng.pid: [rc: -1][Permission denied]
Feb 28 00:00:53 ntop ntopng[1722]: 28/Feb/2020 00:00:53 [HTTPserver.cpp:1350] HTTP server terminated
Feb 28 00:00:53 ntop ntopng[1722]: 28/Feb/2020 00:00:53 [NetworkInterface.cpp:541] Flushing host contacts for interface tcp://127.0.0.1:5556
Feb 28 00:00:54 ntop ntopng[1722]: 28/Feb/2020 00:00:54 [NetworkInterface.cpp:2372] Cleanup interface tcp://127.0.0.1:5556
Feb 28 00:01:03 ntop ntopng[1722]: 28/Feb/2020 00:01:03 [MySQLDB.cpp:744] Disconnected from MySQL for interface tcp://127.0.0.1:5556...
Feb 28 00:01:03 ntop ntopng[1722]: 28/Feb/2020 00:01:03 [MySQLDB.cpp:744] Disconnected from MySQL for interface tcp://127.0.0.1:5556...
Feb 28 00:01:03 ntop ntopng[1722]: 28/Feb/2020 00:01:03 [MySQLDB.cpp:744] Disconnected from MySQL for interface tcp://127.0.0.1:5556...
Feb 28 00:01:03 ntop ntopng[1722]: 28/Feb/2020 00:01:03 [AddressResolution.cpp:63] Address resolution stats [0 resolved][197 failures]
Feb 28 00:01:03 ntop systemd[1]: Stopped ntopng high-speed web-based traffic monitoring and analysis tool.
@emanuele-f
Copy link
Contributor

Please report the output of ntopng --version

@HNJBB
Copy link
Author

HNJBB commented Feb 28, 2020

ntopng --version
v.3.9.200211 [Enterprise/Professional build]
GIT rev: dev:20fe918d665e6556ef759d7aa7d6f25b2faaab24:20200211
Pro rev: r2710
Built on: Ubuntu 18.04.3 LTS
System Id: 6F001919B2066B13
Platform: x86_64
Edition: Enterprise
License Type: Permanent
Maintenance: Until Thu Jun 18 13:27:17 2020 [111 days left]

@emanuele-f
Copy link
Contributor

2020-02-28_12-24
2020-02-28_12-24_1

You can retrieve the failing lists URL from the link above. If you try to access that url from the ntopng server, can you successfully do that? E.g. can you succesfully run curl -L https://talosintelligence.com/documents/ip-blacklist and get the list?

How often does the unexpected shutdown occur?

@HNJBB
Copy link
Author

HNJBB commented Feb 28, 2020

Server can retrieve the lists. And ntopng has also since retrieved the lists. The unexpected shutdown has only occurred this one time. Though we are only recently using ntopng in a production enviroment.

@emanuele-f
Copy link
Contributor

This issue occurs if ntopng is stopped during its startup phase

@emanuele-f emanuele-f added this to the 4.1 milestone Mar 23, 2020
@emanuele-f emanuele-f self-assigned this Mar 27, 2020
emanuele-f pushed a commit that referenced this issue Mar 27, 2020
Add check to avoid "list x has 0 rules" on interrupted shutdowns
35c6c21 
Fixes #3468
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@emanuele-f emanuele-f

Labels
In Progress Low-Priority Bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@emanuele-f @HNJBB