Graylog2 / Graylog2/graylog2-server

[Graylog Security Plugin] unsintall licence generate error in log

Open
#20,240 0 comments 0 reactions 0 assignees View on GitHub
bug triaged
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

After uninstall graylog "security" licence, there some error log which appears periodically.

## Expected Behavior
not logging error about sigma sync because it should be disable.

## Current Behavior
log which appears periodically :
```
2024-08-12T14:44:10.593+02:00 INFO [SigmaRuleStatusSyncService] Scheduling event processor job for out of sync Sigma rule [****************]
2024-08-12T14:44:10.595+02:00 ERROR [SigmaRuleStatusSyncPeriodical] Uncaught exception in Periodical
java.lang.IllegalArgumentException: Event definition <667180cf3f327b013718a9bd> doesn't exist
at org.graylog.events.processor.EventDefinitionHandler.lambda$getEventDefinitionOrThrowIAE$5(EventDefinitionHandler.java:278) ~[graylog.jar:?]
at java.base/java.util.Optional.orElseThrow(Unknown Source) ~[?:?]
at org.graylog.events.processor.EventDefinitionHandler.getEventDefinitionOrThrowIAE(EventDefinitionHandler.java:278) ~[graylog.jar:?]
at org.graylog.events.processor.EventDefinitionHandler.schedule(EventDefinitionHandler.java:228) ~[graylog.jar:?]
at org.graylog.plugins.securityapp.sigma.SigmaRuleStatusSyncService.lambda$syncSigmaRuleEventStatus$6(SigmaRuleStatusSyncService.java:62) ~[?:?]
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(Unknown Source) ~[?:?]
at java.base/java.util.stream.ReferencePipeline$2$1.accept(Unknown Source) ~[?:?]
at java.base/java.util.Iterator.forEachRemaining(Unknown Source) ~[?:?]
at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Unknown Source) ~[?:?]
at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source) ~[?:?]
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source) ~[?:?]
at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(Unknown Source) ~[?:?]
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(Unknown Source) ~[?:?]
at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source) ~[?:?]
at java.base/java.util.stream.ReferencePipeline.forEach(Unknown Source) ~[?:?]
at org.graylog.plugins.securityapp.sigma.SigmaRuleStatusSyncService.syncSigmaRuleEventStatus(SigmaRuleStatusSyncService.java:60) ~[?:?]
at org.graylog.plugins.securityapp.sigma.SigmaRuleStatusSyncPeriodical.doRun(SigmaRuleStatusSyncPeriodical.java:72) ~[?:?]
at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:99) [graylog.jar:?]
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.base/java.util.concurrent.FutureTask.runAndReset(Unknown Source) [?:?]
at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) [?:?]
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.base/java.lang.Thread.run(Unknown Source) [?:?]
```
## Possible Solution
unknow

## Steps to Reproduce (for bugs)
1. install graylog security licence
2. create sigma rule with custom event definition
3. uninstall graylog security licence

## Context
It's a testing environment for exploring Graylog feature like Graylog Security but i want to uninstall it now.
I tried de find this event but it's not exist in the traditionnal menu (Alerts > Event Definitions).

## Your Environment
3 node Graylog, 5 nodes opensearch.

* Graylog Version: 6.0.3+eb761c5
* Java Version: 17.0.12
* OpenSearch Version: 2.11.1
* MongoDB Version: 6.0.16
* Operating System: Rocky Linux release 8.10 (Green Obsidian)
* Browser version: Firefox 129.0.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.