[8.162][BUG][OPEN] Web Application Security Counter still broken on dashboard.

Hi,
The Web Application Security counter shows 0 requests served on the dashboard. The other graphs and logs show that the requests are processing just fine.

Regards
Bill

0 Astaro Beta Bot over 14 years ago

Astaro Beta Report
--------------------------------
Version: 8.162
Type: BUG
State: ASSIGNED/OPEN
Reporter: Billybob+
Contributor: 
MantisID: 17506
Target version: 
Fixed in version: 
--------------------------------

0 kbr over 14 years ago

I have re-checked it here on my machines two times now, and i cannot reproduce this behavior.

What is the output of `[FONT="Courier New"] cc get_dashboard_data |grep -A7 "'waf'" [/FONT]`?

Does the file [FONT="Courier New"]/var/log/reporting/inline/waf.ph[/FONT] exist?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 14 years ago in reply to kbr

Hi Kai, I do have the waf.ph file and here is the output that you asked for:
gatekeeper:/var/log # cc get_dashboard_data |grep -A7 "'waf'"
                           'waf' => {
                                      'attackers' => 0,
                                      'attacks' => 0,
                                      'clients' => 0,
                                      'requests' => 0,
                                      'status' => 1,
                                      'traffic' => 0
                                    },

I believe I have found the problem. WAF status was not active on the dashboard before so this didn't affect anybody but now it is becoming a problem. In my system logs, every time /usr/local/bin/reportcontrol.sh runs I get the following errors:
2011:04:04-13:05:01 gatekeeper /usr/sbin/cron[20479]: (root) CMD (   /usr/local/bin/reportcontrol.sh)
2011:04:04-13:05:02 gatekeeper postgres[20489]: [2-1] ERROR:  invalid input syntax for type inet: ""
2011:04:04-13:05:02 gatekeeper postgres[20489]: [2-2] STATEMENT:  select ins_waf($1, $2, $3, $4, $5, $6, $7, $8)

I had complained about it in previous beta http://www.astaro.org/closed-forums-read-only/asg-v8-betas/asg-v8-000-beta-closed/asg-v8-000-beta-closed-threads/31634-7-910-bug-closed-repeated-errors-system-log.html and it seems other people have this problem on their production systems also http://www.astaro.org/astaro-gateway-products/management-networking-logging-reporting/33040-reporting-error-waf.html so it will be a problem for some upgrades.

Hope this helps
Regards
Bill.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 mle over 14 years ago

Hi Bill,

can you please provide us the full reverseproxy.log from that day (eg. 2011-04-04)?

Regards,
mlenk
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 14 years ago in reply to mle

Hi Micha, here is the file that you asked for.
Regards
Bill.

rp.zip
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 mle over 14 years ago

Hi Bill,

hmm, apparently ActiveSync is the only traffic on your WAF.

Can you please create the file /var/storage/chroot-reverseproxy/tmp/keeplogs, which will cause the WAF reporting to keep the raw WAF reporting files. After a while with some traffic (and again the mentioned errors in your system.log) please provide us the files in /var/storage/chroot-reverseproxy/var/log/audit. These files will help us to reproduce the issue locally.

Regards,
mlenk
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 14 years ago in reply to mle

Hi,
Here is the audit directory. I started this morning around 10am and its about 10:15pm right now so hopefully there is something useful in there. About 1mb data.... enjoy[:D]

Regards
Bill.

Edit: I browsed through some of the files and they seem pretty normal to me. I have enabled ssh and webadmin access if you need to log in remotely. PM sent.

audit.zip
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 mle over 14 years ago

Thank you for the audit logs. We will have a look and contact you if we need more information.

Regards,
mlenk
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 MarCow over 13 years ago

I'm seeing the same behavior on the 8.200 soft release. In fact, since the WAF dashboard counter was first introduced, I've never seen anything besides 0 requests listed. I run Exchange 2010 ActiveSync and OWA through the reverse proxy, as well as a couple of regular web apps (e.g. the built-in web server for the EvoCam webcam product for Mac).
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Billybob over 13 years ago in reply to MarCow

Agreed, its still broken for me also.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel