Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About mattspierce
mattspierce
Explorer
Member since:
02-28-2014
06-05-2020
Community Statistics
| Posts | 6 |
| Solutions | 1 |
| Karma Given | 1 |
| Karma Received | 1 |
| Member Since | 02-28-2014 |
Activity Feed
- Got Karma for Rapid7 Nexpose Technology Add-On for Splunk: Why is the Nexpose Application Service crashing after the add-on runs cron?. 06-05-2020 12:48 AM
- Karma Howto Setup RSYSLOG network event log filtering based on message type - content (sourcetype) for milesbrennan. 06-05-2020 12:47 AM
- Posted Re: Rapid7 Nexpose Technology Add-On for Splunk: Why is the Nexpose Application Service crashing after the add-on runs cron? on All Apps and Add-ons. 03-03-2017 03:08 PM
- Posted Rapid7 Nexpose Technology Add-On for Splunk: Why is the Nexpose Application Service crashing after the add-on runs cron? on All Apps and Add-ons. 02-22-2017 09:13 AM
- Tagged Rapid7 Nexpose Technology Add-On for Splunk: Why is the Nexpose Application Service crashing after the add-on runs cron? on All Apps and Add-ons. 02-22-2017 09:13 AM
- Tagged Rapid7 Nexpose Technology Add-On for Splunk: Why is the Nexpose Application Service crashing after the add-on runs cron? on All Apps and Add-ons. 02-22-2017 09:13 AM
- Posted Re: Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"? on All Apps and Add-ons. 02-19-2016 06:40 AM
- Posted Re: Can Splunk for Juniper SA be used for Juniper MAG devices? on All Apps and Add-ons. 09-24-2014 12:58 PM
- Posted Re: "Can't create directory" on add monitor on Security. 09-17-2014 01:22 PM
- Posted Re: SplunkforSymantec installation question on Installation. 02-28-2014 03:32 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 |
03-03-2017
03:08 PM
After working with support we found in /var/log/messages the error:
messages-20170226:Feb 23 04:30:22 nexpose kernel: lowmem_reserve[]: 0 0 0 0
messages-20170226:Feb 23 04:30:22 nexpose kernel: Out of memory: Kill process 25870 (nexserv) score 372 or sacrifice child
This explains the issue, and luckily my children were not sacrificed.
... View more
02-22-2017
09:13 AM
1 Karma
Good Morning,
I updated my splunk 6.5.2 test environment from the old Rapid7 App to Rapid7 Nexpose Technology Add-On for Splunk last week. Since then my Nexpose instance v6.4.22 is crashing leaving only the nxpsql postgres process running. I have a ticket open with Rapd7 but was wondering if anyone has a similar issue? The API access seems to be working as I have data in my index I created for this app. The nsc.log doesn't show any errors. It just abruptly ends and not necessarily with anything correlating. TA-rapid7_nexpose.log doesn't show any abnormalities I can see. Some time after job ends the app server goes offline.
ps result
nxpgsql 20280 0.0 0.0 164396 4100 ? S 10:11 0:00 /opt/rapid7/nexpose/nsc/nxpgsql/pgsql/bin/postgres -D /opt/rapid7/nexpose/nsc/nxpgsql/nxpdata
nsc.log
Here is the tailend of the API call for the SQL results.
2017-02-22T10:15:10 [INFO] [Thread: critical-task-executor3] [Silo ID: default] [Report: ad_hoc_6447718972749473] [Report Config ID: 9971] [Started: 2017-02-22T10:11:43] [Duration: 0:03:27.277] Calculated 846831 vulnerability finding matches that resulted in 1104369 solution results.
2017-02-22T10:15:11 [INFO] [Thread: critical-task-executor3] [Silo ID: default] [Report: ad_hoc_6447718972749473] [Report Config ID: 9971] [Started: 2017-02-22T10:10:52] [Duration: 0:04:19.407] Finished preparing the reporting data model version 2.0.1.
2017-02-22T10:15:11 [INFO] [Thread: critical-task-executor3] com.rapid7.sql.export.batch.size is not configured - returning default value 100.
2017-02-22T10:15:11 [INFO] [Thread: critical-task-executor3] [Silo ID: default] [Report: ad_hoc_6447718972749473] [Report Config ID: 9971] Executing query 'SELECT asset_id, da.ip_address, da.mac_address, site_id, favf.vulnerability_instances, favf.vulnerability_id, fasva.first_discovered, fasva.most_recently_discovered, dv.title, dv.severity, dvc.categories, dve.skill_levels, dvr.sources, favf.scan_id, dv.cvss_score, dv.date_added, solution_summary, solution_count, solution_types from dim_site_asset RIGHT OUTER JOIN (select favf.asset_id, favf.vulnerability_instances, favf.vulnerability_id, favf.scan_id FROM fact_asset_vulnerability_finding favf) favf USING (asset_id) LEFT OUTER JOIN (select dv.vulnerability_id, dv.title, dv.severity, dv.cvss_score, dv.date_added FROM dim_vulnerability dv) dv USING (vulnerability_id) LEFT OUTER JOIN (select dvc.vulnerability_id, (string_agg(DISTINCT '<' || dvc.category_name, '>') || '>') as categories FROM dim_vulnerability_category dvc GROUP BY dvc.vulnerability_id) dvc USING (vulnerability_id) LEFT OUTER JOIN (select dve.vulnerability_id, (string_agg(DISTINCT '<' || dve.skill_level, '>') || '>') as skill_levels FROM dim_vulnerability_exploit dve GROUP BY dve.vulnerability_id) dve USING (vulnerability_id) LEFT OUTER JOIN (select dvr.vulnerability_id, (string_agg(DISTINCT '<' || dvr.source || ':' || dvr.reference,'>') || '>') as sources FROM dim_vulnerability_reference dvr GROUP BY dvr.vulnerability_id) dvr USING (vulnerability_id) LEFT OUTER JOIN (select fasva.asset_id, fasva.vulnerability_id, fasva.first_discovered, fasva.most_recently_discovered FROM fact_asset_vulnerability_age fasva) fasva USING(asset_id, vulnerability_id) LEFT OUTER JOIN (select da.asset_id, da.ip_address, da.mac_address FROM dim_asset da) da USING (asset_id) LEFT OUTER JOIN (select vulnerability_id, (array_agg(summary))[1] as solution_summary, COUNT(solution_id) as solution_count, string_agg(distinct(solution_type),'|') as solution_types from dim_vulnerability_solution JOIN (select solution_id, solution_type, summary from dim_solution) dsol USING (solution_id) GROUP BY vulnerability_id ) dsv USING (vulnerability_id) WHERE site_id=21 GROUP BY asset_id, da.ip_address, da.mac_address, fasva.first_discovered, fasva.most_recently_discovered, site_id, favf.scan_id, favf.vulnerability_id, favf.vulnerability_instances, dv.title, dv.vulnerability_id, dv.severity, dvc.categories, dve.skill_levels, dvr.sources, dv.cvss_score, solution_count, dsv.solution_summary, dsv.solution_count, dsv.solution_types, dv.date_added '.
2017-02-22T10:15:35 [INFO] [Thread: Thread-859] [172.20.15.253] Scan engine certificate verified.
2017-02-22T10:17:07 [INFO] [Thread: Thread-860] [172.20.15.253] Scan engine certificate verified.
2017-02-22T10:18:39 [INFO] [Thread: Thread-861] [172.20.15.253] Scan engine certificate verified.
2017-02-22T10:20:11 [INFO] [Thread: Thread-862] [172.20.15.253] Scan engine certificate verified.
2017-02-22T10:21:01 [INFO] [Thread: Scheduler] Executing job JobID[Auto-Content-update retriever-78BE780D0C1146315BD57A0CE66EC5CE17D29FE1] Content Update
2017-02-22T10:21:01 [INFO] [Thread: Scheduled Execution Thread: Auto-Content-update retriever-78BE780D0C1146315BD57A0CE66EC5CE17D29FE1] Updating the Security Console content.
2017-02-22T10:22:05 [INFO] [Thread: Thread-864] [172.20.15.253] Scan engine certificate verified.
2017-02-22T10:22:11 [INFO] [Thread: task-executor4] Done with statistics generation [Started: 2017-02-22T10:22:07] [Duration: 0:00:03.582].
2017-02-22T10:22:35 [INFO] [Thread: Scheduled Execution Thread: Auto-Content-update retriever-78BE780D0C1146315BD57A0CE66EC5CE17D29FE1] Updating content on remote scan engines.
2017-02-22T10:23:37 [INFO] [Thread: Thread-865] [172.20.15.253] Scan engine certificate verified.
2017-02-22T10:25:08 [INFO] [Thread: Thread-866] [172.20.15.253] Scan engine certificate verified.
2017-02-22T10:26:40 [INFO] [Thread: Thread-867] [172.20.15.253] Scan engine certificate verified.
2017-02-22T10:28:12 [INFO] [Thread: Thread-868] [172.20.15.253] Scan engine certificate verified.
Here is the break in the logs. The following is when I started the app.
2017-02-22T16:09:35 [INFO] [Thread: main]
2017-02-22T16:09:35 [INFO] [Thread: main] OS Information
2017-02-22T16:09:35 [INFO] [Thread: main] ------------------------------------------------------------
2017-02-22T16:09:35 [INFO] [Thread: main] Current directory: /opt/rapid7/nexpose/nsc
2017-02-22T16:09:35 [INFO] [Thread: main] User name: root
2017-02-22T16:09:35 [INFO] [Thread: main] Computer name: nexpose.place.com
2017-02-22T16:09:35 [INFO] [Thread: main] Operating system: CentOS Linux 6.8
2017-02-22T16:09:35 [INFO] [Thread: main] Total memory: 8061512 KBytes
2017-02-22T16:09:35 [INFO] [Thread: main] Available memory: 6942380 KBytes
2017-02-22T16:09:35 [INFO] [Thread: main] CPU speed: 2399MHz
2017-02-22T16:09:35 [INFO] [Thread: main] Number of CPUs: 1
2017-02-22T16:09:35 [INFO] [Thread: main] Super user: true
2017-02-22T16:09:35 [INFO] [Thread: main] JVM started: Wed Feb 22 10:09:25 CST 2017
2017-02-22T16:09:35 [INFO] [Thread: main] JVM uptime: 6 seconds
2017-02-22T16:09:37 [INFO] [Thread: main]
2017-02-22T16:09:37 [INFO] [Thread: main] OS Information
2017-02-22T16:09:37 [INFO] [Thread: main] ------------------------------------------------------------
TA-rapid7_nexpose.log
2017-02-22 04:04:11,467 INFO nx_logger:38 - In AdHoc generate
2017-02-22 04:04:11,468 INFO nx_logger:38 - Making Query:
2017-02-22 04:06:31,827 INFO nx_logger:38 - Processing asset report for site(s) <['21']>
2017-02-22 04:06:32,120 INFO nx_logger:38 - Finished processing asset report for site(s) <['21']>
2017-02-22 04:08:32,475 INFO nx_logger:38 - Connecting Nexpose client
2017-02-22 04:08:33,054 INFO nx_logger:38 - Executing vuln query for site(s) <['21']>
2017-02-22 04:08:33,055 INFO nx_logger:38 - In AdHoc generate
2017-02-22 04:08:33,055 INFO nx_logger:38 - Making Query:
... View more
02-19-2016
06:40 AM
I am also getting this error. In my case both the app for nix and app for windows are generating it.
Invalid key in stanza [ui] in /opt/splunk/etc/apps/splunk_app_for_nix/default/app.conf, line 18: attribution_link (value: app.attributions).
Invalid key in stanza [ui] in /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/app.conf, line 15: attribution_link (value: app.attributions).
... View more
09-24-2014
12:58 PM
I have two SA 4500's and a Mag 4610. From what I see they are handled the exact same way.
... View more
09-17-2014
01:22 PM
When you start your forwarder do you run the init or call the program via the splunk user or the root user?. My guess would be that you called it form root and your permissions are for the root user. If you do an ls -la you can see who owns the files. I would approach the problem as user root run chown -R splunk:splunk /opt/splunkforwarder/ then ensure you start the forwarder as splunk. Your sudo -u splunk should now be able to make the necessary changes.
... View more
02-28-2014
03:32 PM
I'm having a similar issue. I am seeing events form the symantec server in the data. I do not see the Symantec Plugin recognizing that data. I've located the TA for sep11 and sep12 in /opt/splunk/etc/apps/SplunkforSymantec/appserver/addons but there are no tgz or spl file to install.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:04 AM
|
