SSL Certificate error #11
Comments
|
Hi @OtoKiroo ,
This is pretty much it. I hope it will help. |
|
I was able to create them by turning off https ceritificate then turning it back on, i also tried your method of creating them manually but it does not work. The index Templates exist, but there is nothing in "Indices". When i try to create the index pattern following the github page, it does not want to create the pattern because the ospf-watcher-costs-changes and ospf-watcher-updown-events source does not appear or exist. "Name must match one or more data streams, indices, or index aliases". |
|
@OtoKiroo , |
|
@Vadims06 [+] Running 0/1 I have tried deleting the directory and rebuilding from source, still have the same error. Oddly enough, i now have this error regardless of what i change in the .env file. Even from a fresh install i get this error now. Was there an update/change recently ? |
|
@Vadims06 Thanks ! I havent had time to work again on this project but i will let you know asap if i encounter any other problems |
|
Hey @Vadims06, ive tested the change and it doesnt seem to change anything. ⠿ logstash-index-creator Error 0.8s Same error as before however you see that it is now ospfwatcher-watcher instead of ospfwatcher_watcher. Another question, would you be able to add support for Graylog? thanks |
|
Hi @OtoKiroo ,
|
|
@Vadims06 I had the same error even when rebuilding. I removed the directory and redid it from scratch and it works fine now. DEBUG_BOOL="True" is uncommented, as well as the EXPORT_TO_ELASTICSEARCH_BOOL=True. The rest of the .env file is configured properly as far as i can tell, but i still do not get any logs and the indices are missing. I tried manually creating the Index Templates as well as modifying the python script to work with HTTP to create them, both methods work, but still no Indices. As for the graylog GELF, im not familliar at all but here is what i've added to the very bottom of the logstash.conf: Obviously i wont know if it works until i fix the issue though. docker logs logstash doesnt show any logs being exported to ELK Stack from ospfwatcher. |
|
Is the GRE tunnel needed even if using test mode ? I've decided to make a new elk-stack in docker this time, configured the index templates manually as shown above and i still get no indices or logs sent from ospfwatcher to elk-stack. topolograph is confured properly with a .txt file as a test from lsdb, real-time monitoring still shows ospfwatcher as not configured and without logs, ospfwatcher .env is configured properly with debug_bool="True" and test_mode="True". Export_to_elasticsearch_bool=True is uncommented as well. All the other variables are set properly, with IP, ports, username/password, etc.. |
|
@OtoKiroo ,
No, it's not needed. |
|
@Vadims06 WARN[0000] The "EXPORT_TO_ZABBIX_BOOL" variable is not set. Defaulting to a blank string. |
|
thanks for the output. It runs How to check that Watcher exports logs with DEBUG enabled
|
|
I also added |
|
Here is the output for the command. For elk stack, security is false and to basic instead of trial. I can confirm the user and user password are set correctly. |
|
When checking, logstash was not running from ospfwatcher directory. docker compose up -d and now it started properly. docker-elk also has its own logstash. I changed a conflicting port but the output from docker compose ps shows that both logstash use identical ports. Conflicting port was 50000 when building elk stack, changed to 50001. After a few minutes, the ospfwatcher_logstash disapeared again. logstash from docker-elk is overwriting the one from ospfwatcher it seems, or the docker is crashing after a few minutes. I will revert to using external elk stack instead of docker |
|
@Vadims06 |
|
@OtoKiroo could you please share ELK and docker-compose version what you are currently using? I will try to setup the same environment |
|
Docker compose version 2.16.0, using portainer as GUI, but i am doing everything through CLI. |
|
Here are the logs for logstash that keeps crashing. Even with elk-stack removed, it still happens. |
|
@OtoKiroo Here is a log of Index templates with OSPF Watcher indexes |
|
@Vadims06 Logstash-index-creator logs: |
There is two general advices how to behave during https://discuss.elastic.co/t/unable-to-authenticate-user-for-rest-request/197461, please also check it.
Inside OSPF Watcher Run |
|
@Vadims06 |
|
Hi @OtoKiroo |
|
@Vadims06 Hi, sorry for the late reply.. i've been very busy with other projects in the past weeks. Ive updated docker compose(Go version) to the most recent 2.27.0 version. I dont use the older V1 docker-compose (Python), which you seem to use. I am re-building from scratch on a new docker environment. So far i am getting this error: This is because: I will working on it this week. I will keep you updated if anything more shows up. Removing "version" from the docker-compose.yaml fixes this issue. |
|
@Vadims06 Does the webhook URL export only support SLACK format ? It does not seem to work with discord, google chat webhook URL's.
As for the rest, i am still getting no logs to elk stack, with unauthorized error using external elk-stack. Will try with docker elk-stack again and will keep you informed |
|
@Vadims06 So ive finally managed to make it work with local docker elk-stack, the index templates were created by logstash index creator, however, when creating the Data View, it returns sudo docker exec -it quagga cat /var/log/quagga/ospfd.log returns nothing. I am still using test_mode, so no GRE tunnel has been configured yet. |
|
Hi @OtoKiroo , |
|
Hi @OtoKiroo , |
Hi, could you provide an example for the python script to accept ELK certificate? I am already running an instance of the ELK stack through WAZUH on a VM. I tried removing the authentication and using HTTP but the GUI used for ELK is not accessible using http, however the script works fine and gives no errors with no auth.
topolograph and ospfwatcher are running on seperate dockers, while the ELK stack is running on a VM
requests.exceptions.SSLError: HTTPSConnectionPool(host='10.100.0.10', port=9200): Max retries exceeded with url: /_index_template/ospf-watcher-updown-events (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)')))
I am not an expert with python or programming in general,
Thanks !
The text was updated successfully, but these errors were encountered: