-
Notifications
You must be signed in to change notification settings - Fork 437
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ERROR: Failed to run the reporting module "MongoDB" #2188
Comments
Try to disable capa in processing and reprocess a job just as test |
CAPA disabled in processing and submited new sample with default options. Now it has a timeout: I think that CAPA is not the problem, since my sample is a .doc, so this error message is correct from CAPA. Anyway, I'm working with snapshots (CAPE-host is a VM) and I notice that this error starts since I installed Volatility3 and flare-floss via poetry:
Will be it related? |
could be, i don't use capa, floss neither volatility integrations so idk in which state those plugins are |
So, if I understand the memory analysis with Volatility should be done outside CAPE-host, right? |
well you can use that in cape, but the thing here is that i don't maintain things that i don't use, is just unreal, so sometime community or other people must help support updated version of those libraries, it should works with the versions that is in pyproject, but if you install newer, then that's not ensured by us. |
Ok perfect. I confirm that if I install Volatility, the cape-processor crashes. |
Hi again! I setup tmpfs for memory dump analysis with Volatility and it doesn't crash due to timeout now. |
News... I check that some Volatility modules configured in memory.conf are crashing MongoDB reports (first log error in this issue). |
what modules crashing it? yes tmpfs speedup a lot processing of memdumps, but bear in mind as much plugins you enable, you might need to consider increase timeout from 900 to higher value |
malfind is the first module that causes the crash. If you see the first screenshot in the issue, the exception is throwed at |
Probably it returns something that wasn't converted to json |
Mm, not sure about that. I tried to replace the |
That's interesting, hm would need to investigate once I have some spare time
El jue, 27 jun 2024, 14:35, Alberto Sosa ***@***.***>
escribió:
… Mm, not sure about that. I tried to replace the deepcopy with a JSON dump
and load (only for test purposes) and it doesn't throw exceptions - errors.
I've all modules enabled in memory.conf and it shows all information in
web interface.
—
Reply to this email directly, view it on GitHub
<#2188 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AAOFH3YYYGPLGMAVSWL47CTZJQBHTAVCNFSM6AAAAABJ5XJYRSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCOJUGU3DKMRYGU>
.
You are receiving this because you commented.Message ID:
***@***.***>
|
Prerequisites
Please answer the following questions for yourself before submitting an issue.
Expected Behavior
Finished analysis with reports.
Current Behavior
When I submit a sample to analize, an unhandled exception is throwed. See Failure Logs section. I've installed Volatility3 to full memory dump analysis.
Steps to Reproduce
Please provide detailed steps for reproducing the issue.
Context
Config files:
cuckoo.conf
auxiliary.conf
kvm.conf
memory.conf
processing.conf
reporting.conf
web.conf
Failure Logs
The text was updated successfully, but these errors were encountered: