EveBox not working

I reacently installed IPS.
I can’t open eveBox, the link from the cockpitpage is https://myServer:980/bunchofnumbers. it’s opening an new tab and running in a timeout.
I checked the messages log and have lot of Messages like:

2022-12-21 21:26:12 (indexer.go:156) <Error> -- attempt to write a readonly database
2022-12-21 21:26:12 (evefileprocessor.go:218) <Error> -- Failed to commit events, will try again: attempt to write a readonly database

I tried already to reinstall EveBox but did not help at all.

Just to see what is noted, as root on the console can you try:

config show evebox

But hash out the alias / ‘bunch of numbers’ for security reasons.

Hi @pnemenz

The link you provide (pointing to a timeout) indicates port 980, pointing out to the older server manager.
Do you have that installed? It can be installed from Software Center or with

yum install nethserver-httpd-admin

The older Server Manager, also called nethGUI, is no longer pre-installed in the latest NethServer.
It may be a requirement, I don’t use evebox myself.

My 2 cents

Hi @Andy_Wismer ,
looks like you’re right.
I had the httpd-admin installed but deactivated. After reactivating and restarting the firewall EveBox now seems to work.
Thankyou for this hint.

1 Like

Hi @LayLow

Here the output:

config show evebox
    alias=buch of numbers again :)

when running the old httpd-admin, then it works (see below). Should’nt it work without it?


It should, but a while ago I remember reading about the issue (similiar), and it seems the linking of the callup (the :980 link) was never adapted for Cockpit… (I think in the reverse proxy…)
I didn’t really “register” it, as I don’t use evebox, but your post triggered the memory… :slight_smile:

Seems to be correct with the link… :slight_smile:

My 2 cents

Update: I can access the EveBox page but there are no Data coming in, sill have a lot of Error Messages in the logfile.

(indexer.go:156) <Error> -- attempt to write a readonly database
(evefileprocessor.go:218) <Error> -- Failed to commit events, will try again: attempt to write a readonly database

As root can you:

ls -l /var/lib/evebox


ls -l /var/lib/evebox
insgesamt 9320
-rw-r--r-- 1 suricata suricata   40960 12. Dez 11:44 config.sqlite
-rw-r--r-- 1 suricata suricata 9498624 16. Dez 21:51 events.sqlite

Those permissions seem fine. Obviously I was looking at the related to SQLite database that Suricata uses.

Is suggest you google for the issue re Evebox in general or specific user forums.