dionaea
dionaea copied to clipboard
Incident log wrongly records all hpfeeds activities
ISSUE TYPE
- Bug Report
DIONAEA VERSION
Dionaea Version 0.8.0-17-g93d5bf9
Compiled on Linux/x86_64 at Aug 16 2018 04:33:14 with gcc 6.3.0 20170516
Started on buffy running Linux/x86_64 release 4.9.0-7-amd64
CONFIGURATION
- Using
hpfeeds
plug in to report activites tomhn
hpfeeds broker. - Other settings are set by default, no change has been made.
OS / ENVIRONMENT
- Debian 8.0
SUMMARY
In the incident file dionaea_incident.json
by plug in log_incident
, there are so many records of dionaea.modules.python.hpfeeds.dynipresult
and dionaea.upload.request
which have no meaning. It is not an incident, it just hpfeeds
activities in some sorts. And there is nothing to be found either in var/lib/dionaea/binaries//httpupload-XXXXXX
. In short, it just fills up the incident log with a lot of noise.
{"data": {"_callback": "dionaea.modules.python.hpfeeds.dynipresult", "_url": "http://icanhazip.com/"}, "origin": "dionaea.upload.request", "name": "dionaea", "timestamp": "2018-08-16T09:11:36.937644"}
{"data": {"path": "var/lib/dionaea/binaries//httpupload-vsdh4V"}, "origin": "dionaea.modules.python.hpfeeds.dynipresult", "name": "dionaea", "timestamp": "2018-08-16T09:11:37.181555"}
STEPS TO REPRODUCE
EXPECTED RESULTS
hpfeeds
activities should be ignored.
ACTUAL RESULTS
There are too many records of this kind in the incident log.
{"data": {"_callback": "dionaea.modules.python.hpfeeds.dynipresult", "_url": "http://icanhazip.com/"}, "origin": "dionaea.upload.request", "name": "dionaea", "timestamp": "2018-08-16T09:11:36.937644"}
{"data": {"path": "var/lib/dionaea/binaries//httpupload-vsdh4V"}, "origin": "dionaea.modules.python.hpfeeds.dynipresult", "name": "dionaea", "timestamp": "2018-08-16T09:11:37.181555"}