Giters

hubblestack / hubble

Hubble is a modular, open-source security compliance framework. The project provides on-demand profile-based auditing, real-time security event notifications, alerting, and reporting.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

System_uuid grain previously saved on disk doesn't match live system value

gdbtek opened this issue · comments

commented

we failed to start up Hubble and wondering if anyone knows what seem to be the problem


# ./hubble --buildinfo
{'branch': 'v4.5.1', 'last_commit': 'v4.5.1-0-g35d04f2a', 'iteration': 1}


# cat /var/log/hubble
2021-10-05 17:26:51,312 [ERROR] [hubblestack.daemon:589]  potentially cloned system detected: System_uuid grain previously saved on disk doesn't match live system value.
Resettig cached hubble_uuid value.
2021-10-05 17:26:53,864 [INFO ] [hubblestack.modules.cmdmod:505]  Executing command 'ip route show to 0/0' in directory '/root'
2021-10-05 17:26:53,885 [WARNING] [hubble.loaded.int.grains.hubbleuuid:42]  generating fresh uuid, no cache file found. (probably not a problem)
2021-10-05 17:26:54,147 [ERROR] [hubble.loaded.int.grains.systemuuid:53]  system_uuid on disk doesn't match live system value
Live: EC2B79A7-8572-9559-F69D-C659B2528C85
On Disk: EC2615E1-72A4-5680-DFD0-D4443FD39340
Rewriting cached value
2021-10-05 17:26:55,397 [INFO ] [hubblestack.daemon:141]  Setting up the fileclient/fileserver
2021-10-05 17:26:55,710 [INFO ] [root:185]  Updating cache of azure container
2021-10-05 17:27:19,171 [INFO ] [root:185]  Updating cache of azure container
2021-10-05 17:28:06,649 [INFO ] [hubblestack.daemon:166]  Starting main loop
2021-10-05 17:28:06,650 [INFO ] [hubblestack.daemon:105]  Refreshing grains


# systemctl status hubble
● hubble.service - Hubblestack
   Loaded: loaded (/usr/lib/systemd/system/hubble.service; enabled; vendor preset: disabled)
   Active: activating (auto-restart) (Result: signal) since Tue 2021-10-05 17:48:04 UTC; 22s ago
  Process: 12828 ExecStart=/opt/hubble/hubble -d (code=exited, status=0/SUCCESS)
 Main PID: 13067 (code=killed, signal=ABRT)

Oct 05 17:48:04 development-use1-api-066daee8d336dd39f systemd[1]: hubble.service: main process exited, code=killed, status=6/ABRT
Oct 05 17:48:04 development-use1-api-066daee8d336dd39f systemd[1]: Unit hubble.service entered failed state.
Oct 05 17:48:04 development-use1-api-066daee8d336dd39f systemd[1]: hubble.service failed.

ct 05 17:48:02 development-use1-api-066daee8d336dd39f systemd[1]: Starting Hubblestack...
Oct 05 17:48:03 development-use1-api-066daee8d336dd39f systemd[1]: Can't open PID file /var/run/hubble.pid (yet?) after start: No such file or directory
Oct 05 17:48:03 development-use1-api-066daee8d336dd39f systemd[1]: hubble.service: Supervising process 13067 which is not our child. We'll most likely not notice when it exits.
Oct 05 17:48:03 development-use1-api-066daee8d336dd39f systemd[1]: Started Hubblestack.
Oct 05 17:48:04 development-use1-api-066daee8d336dd39f systemd[1]: hubble.service: main process exited, code=killed, status=6/ABRT
Oct 05 17:48:04 development-use1-api-066daee8d336dd39f systemd[1]: Unit hubble.service entered failed state.
Oct 05 17:48:04 development-use1-api-066daee8d336dd39f systemd[1]: hubble.service failed.
commented

I found the issue. We cleaned up /var/cache/* folder after baking AMI , which will delete /var/cache/hubble folder. This will break in new Hubble version. The older Hubble version worked just fine even /var/cache/hubble get deleted.