dionaea icon indicating copy to clipboard operation
dionaea copied to clipboard

Incident log wrongly records all hpfeeds activities

Open sereysethy opened this issue 6 years ago • 0 comments

ISSUE TYPE
  • Bug Report
DIONAEA VERSION
Dionaea Version 0.8.0-17-g93d5bf9 
Compiled on Linux/x86_64 at Aug 16 2018 04:33:14 with gcc 6.3.0 20170516 
Started on buffy running Linux/x86_64 release 4.9.0-7-amd64

CONFIGURATION
  • Using hpfeeds plug in to report activites to mhn hpfeeds broker.
  • Other settings are set by default, no change has been made.
OS / ENVIRONMENT
  • Debian 8.0
SUMMARY

In the incident file dionaea_incident.json by plug in log_incident, there are so many records of dionaea.modules.python.hpfeeds.dynipresult and dionaea.upload.request which have no meaning. It is not an incident, it just hpfeeds activities in some sorts. And there is nothing to be found either in var/lib/dionaea/binaries//httpupload-XXXXXX. In short, it just fills up the incident log with a lot of noise.

{"data": {"_callback": "dionaea.modules.python.hpfeeds.dynipresult", "_url": "http://icanhazip.com/"}, "origin": "dionaea.upload.request", "name": "dionaea", "timestamp": "2018-08-16T09:11:36.937644"}

{"data": {"path": "var/lib/dionaea/binaries//httpupload-vsdh4V"}, "origin": "dionaea.modules.python.hpfeeds.dynipresult", "name": "dionaea", "timestamp": "2018-08-16T09:11:37.181555"}
STEPS TO REPRODUCE
EXPECTED RESULTS

hpfeeds activities should be ignored.

ACTUAL RESULTS

There are too many records of this kind in the incident log.

{"data": {"_callback": "dionaea.modules.python.hpfeeds.dynipresult", "_url": "http://icanhazip.com/"}, "origin": "dionaea.upload.request", "name": "dionaea", "timestamp": "2018-08-16T09:11:36.937644"}

{"data": {"path": "var/lib/dionaea/binaries//httpupload-vsdh4V"}, "origin": "dionaea.modules.python.hpfeeds.dynipresult", "name": "dionaea", "timestamp": "2018-08-16T09:11:37.181555"}

sereysethy avatar Aug 21 '18 07:08 sereysethy