EveBox not working

Support
,
1

I reacently installed IPS.
I can’t open eveBox, the link from the cockpitpage is https://myServer:980/bunchofnumbers. it’s opening an new tab and running in a timeout.
I checked the messages log and have lot of Messages like:

2022-12-21 21:26:12 (indexer.go:156) <Error> -- attempt to write a readonly database
2022-12-21 21:26:12 (evefileprocessor.go:218) <Error> -- Failed to commit events, will try again: attempt to write a readonly database

I tried already to reinstall EveBox but did not help at all.

2

Just to see what is noted, as root on the console can you try:

config show evebox

But hash out the alias / ‘bunch of numbers’ for security reasons.

3

Hi @pnemenz

The link you provide (pointing to a timeout) indicates port 980, pointing out to the older server manager.
Do you have that installed? It can be installed from Software Center or with

yum install nethserver-httpd-admin

The older Server Manager, also called nethGUI, is no longer pre-installed in the latest NethServer.
It may be a requirement, I don’t use evebox myself.

My 2 cents
Andy

4

Hi @Andy_Wismer ,
looks like you’re right.
I had the httpd-admin installed but deactivated. After reactivating and restarting the firewall EveBox now seems to work.
Thankyou for this hint.
Peter

1 Like
5

Hi @LayLow

Here the output:

config show evebox
evebox=service
    Retention=30
    TCPPort=5636
    access=
    alias=buch of numbers again :)
    status=enabled

when running the old httpd-admin, then it works (see below). Should’nt it work without it?

6

@pnemenz

It should, but a while ago I remember reading about the issue (similiar), and it seems the linking of the callup (the :980 link) was never adapted for Cockpit… (I think in the reverse proxy…)
I didn’t really “register” it, as I don’t use evebox, but your post triggered the memory… :slight_smile:

Seems to be correct with the link… :slight_smile:

My 2 cents
Andy

7

Update: I can access the EveBox page but there are no Data coming in, sill have a lot of Error Messages in the logfile.

(indexer.go:156) <Error> -- attempt to write a readonly database
(evefileprocessor.go:218) <Error> -- Failed to commit events, will try again: attempt to write a readonly database
8

As root can you:

ls -l /var/lib/evebox

9

sure

ls -l /var/lib/evebox
insgesamt 9320
-rw-r--r-- 1 suricata suricata   40960 12. Dez 11:44 config.sqlite
-rw-r--r-- 1 suricata suricata 9498624 16. Dez 21:51 events.sqlite
10

Those permissions seem fine. Obviously I was looking at the related to SQLite database that Suricata uses.

Is suggest you google for the issue re Evebox in general or specific user forums.

HTH