Unable to download Observables after successful upload

[jpark952]

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Ubuntu,

| TheHive version / git hash | 3.x, hash of the commit
| Package Type | DB
| Browser type & version | chromium/firefox

Problem Description

after following the instruction here:
"https://burnhamforensics.com/2018/12/17/installing-thehive-a-security-ir-platform/"

i was able to successfully build a instance of the HIVE, after creating cases, i am able to upload observable successfully, but when i try to download them i get an error.

error

{"type":"java.nio.file.NoSuchFileException","message":"/tmp/playtemp6864110579205867371/zip79854213664040215108c8ea27f1feddeb76d7a92dbfccf7bf73dcd46cee49763220902f68617922eed"}

[nadouani]

Hello, Do you have more logs? We didn't produce the blog post you have referred to, to install your instance, so we don't know if there is something wrong on it.

I would say it's probably a permission issue.

[jpark952]

2019-08-20 09:29:49,942 [INFO] from org.elastic4play.ErrorHandler in application-akka.actor.default-dispatcher-14 - GET /api/datastorezip/cd52d81e25f372e6fa4db2c0dfceb59862c1969cab17096da352b34950c973cc?name=20m.txt returned 500
java.nio.file.NoSuchFileException: /tmp/playtemp8258409183779412450/zip9196599838327613481cd52d81e25f372e6fa4db2c0dfceb59862c1969cab17096da352b34950c973cc
at sun.nio.fs.UnixException.translateToIOException(UnixException.java:86)
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:102)
at sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:107)
at sun.nio.fs.UnixFileAttributeViews$Basic.readAttributes(UnixFileAttributeViews.java:55)
at sun.nio.fs.UnixFileSystemProvider.readAttributes(UnixFileSystemProvider.java:144)
at sun.nio.fs.LinuxFileSystemProvider.readAttributes(LinuxFileSystemProvider.java:99)
at java.nio.file.Files.readAttributes(Files.java:1737)
at java.nio.file.Files.size(Files.java:2332)
at controllers.AttachmentCtrl.$anonfun$downloadZip$1(AttachmentCtrl.scala:99)
at scala.Function1.$anonfun$andThen$1(Function1.scala:52)
at org.elastic4play.controllers.Authenticated$$anon$1.$anonfun$invokeBlock$1(Authenticated.scala:279)
at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:303)
at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:37)
at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:81)
at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)
at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:40)
at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:44)
at akka.dispatch.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260)
at akka.dispatch.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339)
at akka.dispatch.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979)
at akka.dispatch.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)

[jpark952]

i am able to download some files but not others, maybe there is a size issue?

[ITServ-DE]

Are there Unicode-Charactes in the file name?

[ITServ-DE]

And could you please be more preceise than "observable"? What type of observable? I was guessing you uploaded a file and couldn't download it, but it only was a guess ...

[jpark952]

This is with various files, not with Unicode characters.
I can create a simple .txt file, upload it as an observable, download it fine, then try and download it a second time a get this issue.

[ITServ-DE]

... and you try a third and forth time, and the download is successful?

I have seen a similar unsolved issue here ... #1089. Howver, that one has random upload problems ...

[jpark952]

this also occurs on the training vm

[ITServ-DE]

Replace openJDK with the Oracle JVM. I guess this will solve your problem.

Would you please report back? This case is interesting. Thank you.

[jpark952]

ill try tomorrow, as this issue is on both the training VM and installing from "apt-get install thehive" both use openjdk

[jpark952]

i have installed the oracle JDK
java -version now reads

java 12.0.2.2019-07-16
Java(TM) SE Runtime Environment (build 12.0.2+10)
Java HotSpot(TM_) 64-Bit Server Vm (Build 12.0.2+10, mixed mode, sharing)

im still unable to download file observables that i have uploaded

[ITServ-DE]

@jpark952

you write

im still unable to download file observables that i have uploaded

and before you wrote

i am able to download some files but not others, maybe there is a size issue?

I will gladly assist you as good as possible, but I need you to be preceise. Can you please clarify if you have the problem always or sometimes. Thank you.

To make progress, please install strace on your host, if it's not already there. Then please trace the system calls during file download (prepare the download, start strace -o /tmp/strace.out -f -e openat -p {TheHivePID}, download file). Then, stop strace.

If the download failed, please post the contents of the trace file (/tmp/strace.out) here or somewhere where I can view them. If the download was OK, repeat the sequence start strace -> download -> stop strace until we catch a failed download.

[jpark952]

### This is the Strace output after a successful upload of a file observable and the download of that observable:

9610 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78280} --- 9610 +++ exited with 0 +++ 9611 +++ exited with 0 +++ 8400 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody3621071495406348724asTemporaryFile", O_WRONLY|O_CREAT|O_EXCL, 0600) = 349 9613 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody3621071495406348724asTemporaryFile", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 349 9618 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody3621071495406348724asTemporaryFile", O_RDONLY) = 349 9621 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78d80} --- 9622 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody3621071495406348724asTemporaryFile", O_RDONLY) = 349 9626 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody3621071495406348724asTemporaryFile", O_RDONLY) = 349 9614 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody3621071495406348724asTemporaryFile", O_RDONLY) = 349 9615 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody3621071495406348724asTemporaryFile", O_RDONLY) = 349 8399 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 9619 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody3621071495406348724asTemporaryFile", O_RDONLY) = 349 9624 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody3621071495406348724asTemporaryFile", O_RDONLY) = 349 8399 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 9613 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody3621071495406348724asTemporaryFile", O_RDONLY) = 349 8400 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78b80} --- 8384 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78900} --- 9619 +++ exited with 0 +++ 9617 +++ exited with 0 +++ 9628 +++ exited with 0 +++ 9624 +++ exited with 0 +++ 9618 +++ exited with 0 +++ 9626 +++ exited with 0 +++ 9627 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78880} --- 9621 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78d80} --- 9623 +++ exited with 0 +++ 9615 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78e80} --- 9627 +++ exited with 0 +++ 9621 +++ exited with 0 +++ 9613 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78700} --- 9615 +++ exited with 0 +++ 9613 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78700} --- 9625 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78b00} --- 9613 +++ exited with 0 +++ 9625 +++ exited with 0 +++ 9620 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78480} --- 9620 +++ exited with 0 +++ 9614 +++ exited with 0 +++ 9622 +++ exited with 0 +++ 9616 +++ exited with 0 +++ 9629 +++ exited with 0 +++ 8399 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78b80} --- 8387 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78480} --- 8377 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78d80} --- 9630 +++ exited with 0 +++ 8386 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/zip2815923803806116579f7c82c369aba3c979324242f743885e16e075d80afac663a6cadca9a0d183ed5", O_WRONLY|O_CREAT|O_EXCL, 0600) = 349 8386 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/zip2815923803806116579f7c82c369aba3c979324242f743885e16e075d80afac663a6cadca9a0d183ed5", O_RDWR|O_CREAT, 0666) = 349 9646 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/zip2815923803806116579f7c82c369aba3c979324242f743885e16e075d80afac663a6cadca9a0d183ed5", O_RDONLY) = 349 9636 +++ exited with 0 +++ 9638 +++ exited with 0 +++ 9643 +++ exited with 0 +++ 9634 +++ exited with 0 +++ 9635 +++ exited with 0 +++ 9646 +++ exited with 0 +++ 9640 +++ exited with 0 +++ 9639 +++ exited with 0 +++ 9637 +++ exited with 0 +++ 9632 +++ exited with 0 +++ 9645 +++ exited with 0 +++ 9642 +++ exited with 0 +++ 9644 +++ exited with 0 +++ 9641 +++ exited with 0 +++ 9633 +++ exited with 0 +++ 9631 +++ exited with 0 +++

### This is the strace output of a successful upload of a second file observable, that failed when i tried to download it:

9454 +++ exited with 0 +++ 9657 +++ exited with 0 +++ 8398 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody5731478005741028617asTemporaryFile", O_WRONLY|O_CREAT|O_EXCL, 0600) = 191 9658 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody5731478005741028617asTemporaryFile", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 191 8416 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78e80} --- 9671 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody5731478005741028617asTemporaryFile", O_RDONLY) = 191 9673 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78c80} --- 9670 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody5731478005741028617asTemporaryFile", O_RDONLY) = 191 8386 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 9674 +++ exited with 0 +++ 9658 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody5731478005741028617asTemporaryFile", O_RDONLY) = 191 8399 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 9658 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78b80} --- 8386 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78400} --- 9659 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody5731478005741028617asTemporaryFile", O_RDONLY) = 191 9673 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody5731478005741028617asTemporaryFile", O_RDONLY) = 193 8386 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78400} --- 8400 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 9662 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody5731478005741028617asTemporaryFile", O_RDONLY) = 191 8398 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 9675 +++ exited with 0 +++ 9664 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody5731478005741028617asTemporaryFile", O_RDONLY) = 191 8399 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 9661 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/multipartBody5731478005741028617asTemporaryFile", O_RDONLY) = 191 8404 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 8377 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78d80} --- 8384 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 9663 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78700} --- 9659 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78900} --- 8377 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78d80} --- 9668 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78e00} --- 9667 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78400} --- 9658 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78b80} --- 9673 +++ exited with 0 +++ 9668 +++ exited with 0 +++ 9658 +++ exited with 0 +++ 9660 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78b00} --- 9671 +++ exited with 0 +++ 9659 +++ exited with 0 +++ 9666 +++ exited with 0 +++ 9667 +++ exited with 0 +++ 9663 +++ exited with 0 +++ 9670 +++ exited with 0 +++ 9661 +++ exited with 0 +++ 9664 +++ exited with 0 +++ 9660 +++ exited with 0 +++ 9672 +++ exited with 0 +++ 9665 +++ exited with 0 +++ 9669 +++ exited with 0 +++ 9662 +++ exited with 0 +++ 9676 +++ exited with 0 +++ 8411 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78600} --- 8416 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78e80} --- 8398 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78200} --- 8386 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78400} --- 8377 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78d80} --- 8386 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/zip62139159928333294598c8ea27f1feddeb76d7a92dbfccf7bf73dcd46cee49763220902f68617922eed", O_WRONLY|O_CREAT|O_EXCL, 0600) = 349 8386 openat(AT_FDCWD, "/tmp/playtemp2564511578226821721/zip62139159928333294598c8ea27f1feddeb76d7a92dbfccf7bf73dcd46cee49763220902f68617922eed", O_RDWR|O_CREAT, 0666) = 349 8386 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78400} --- 8387 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 8411 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 8411 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78600} --- 9693 +++ exited with 0 +++ 8386 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78400} --- 8387 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f79000} --- 8386 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78400} --- 9692 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78b00} --- 9683 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x7f1c43f78f00} --- 9686 +++ exited with 0 +++ 9689 +++ exited with 0 +++ 9685 +++ exited with 0 +++ 9691 +++ exited with 0 +++ 9692 +++ exited with 0 +++ 9683 +++ exited with 0 +++ 9681 +++ exited with 0 +++ 9678 +++ exited with 0 +++ 9690 +++ exited with 0 +++ 9680 +++ exited with 0 +++ 9688 +++ exited with 0 +++ 9684 +++ exited with 0 +++ 9679 +++ exited with 0 +++ 9677 +++ exited with 0 +++ 9687 +++ exited with 0 +++ 9682 +++ exited with 0 +++ 9695 +++ exited with 0 +++

[jpark952]

i notice this error when i add an observable that failes to download.

2019-09-12 00:47:20,693 [ERROR] from services.AuditActor in application-akka.actor.default-dispatcher-4 - Audit error org.elastic4play.AttributeCheckingError: [Invalid format for audit.details: JsonInputValue({"filepath":"/tmp/playtemp13813776108945230518/multipartBody4714763815644535906asTemporaryFile","name":"ch1.pcap","type":"FileInputValue","contentType":"application/octet-stream"}), expected attachment] at org.elastic4play.services.FieldsSrv.$anonfun$parse$7(FieldsSrv.scala:33) at org.scalactic.Bad.transform(Or.scala:1386) at org.elastic4play.services.FieldsSrv.parse(FieldsSrv.scala:33) at org.elastic4play.services.CreateSrv.create(CreateSrv.scala:105) at org.elastic4play.services.CreateSrv.apply(CreateSrv.scala:67) at services.AuditActor$$anonfun$receive$1.applyOrElse(AuditSrv.scala:136) at akka.actor.Actor.aroundReceive(Actor.scala:517) at akka.actor.Actor.aroundReceive$(Actor.scala:515) at services.AuditActor.aroundReceive(AuditSrv.scala:101) at akka.actor.ActorCell.receiveMessage(ActorCell.scala:592) at akka.actor.ActorCell.invoke(ActorCell.scala:561) at akka.dispatch.Mailbox.processMailbox(Mailbox.scala:258) at akka.dispatch.Mailbox.run(Mailbox.scala:225) at akka.dispatch.Mailbox.exec(Mailbox.scala:235) at akka.dispatch.forkjoin.ForkJoinTask.doExec(ForkJoinTask.java:260) at akka.dispatch.forkjoin.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1339) at akka.dispatch.forkjoin.ForkJoinPool.runWorker(ForkJoinPool.java:1979) at akka.dispatch.forkjoin.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:107)

Is the a list of specific file types that are can be added as an observable?

[ITServ-DE]

Your JVM crashes with a segmentation error. That what the SIGSEGV signal means.

Try upgrading or replacing your JVM with a different kind (openjvm -> Oracle JVM and vice versa, maybe another supplier).

@nadouani, @saadkadhi : this is the second time where I see JVMs crashing randomly when it comes to file downloads (#1089 and this case). A JVM crashing with a segmentation fault is clearly a JVM problem, not a thehive issue. But maybe you can work out under which circumstances the JVM crash occures and open a support ticket at OpenJVM?

However, I can't do more here.

[jpark952]

This error occurs on the training VM also, im just wondering if the is a limit on the type or size of files you can create as an observable, or should you be able to upload any file?

[Passimist]

Hi I am the guy from #1089 . I am having the same issue. (This JVM Error seems to haunt me.) If I can help resolving this hit me up.