Graylog2 / Graylog2/graylog2-server
[Graylog Security Plugin] unsintall licence generate error in log
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
After uninstall graylog "security" licence, there some error log which appears periodically.
## Expected Behavior
not logging error about sigma sync because it should be disable.
## Current Behavior
log which appears periodically :
```
2024-08-12T14:44:10.593+02:00 INFO [SigmaRuleStatusSyncService] Scheduling event processor job for out of sync Sigma rule [****************]
2024-08-12T14:44:10.595+02:00 ERROR [SigmaRuleStatusSyncPeriodical] Uncaught exception in Periodical
java.lang.IllegalArgumentException: Event definition <667180cf3f327b013718a9bd> doesn't exist
at org.graylog.events.processor.EventDefinitionHandler.lambda$getEventDefinitionOrThrowIAE$5(EventDefinitionHandler.java:278) ~[graylog.jar:?]
at java.base/java.util.Optional.orElseThrow(Unknown Source) ~[?:?]
at org.graylog.events.processor.EventDefinitionHandler.getEventDefinitionOrThrowIAE(EventDefinitionHandler.java:278) ~[graylog.jar:?]
at org.graylog.events.processor.EventDefinitionHandler.schedule(EventDefinitionHandler.java:228) ~[graylog.jar:?]
at org.graylog.plugins.securityapp.sigma.SigmaRuleStatusSyncService.lambda$syncSigmaRuleEventStatus$6(SigmaRuleStatusSyncService.java:62) ~[?:?]
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(Unknown Source) ~[?:?]
at java.base/java.util.stream.ReferencePipeline$2$1.accept(Unknown Source) ~[?:?]
at java.base/java.util.Iterator.forEachRemaining(Unknown Source) ~[?:?]
at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Unknown Source) ~[?:?]
at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source) ~[?:?]
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source) ~[?:?]
at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(Unknown Source) ~[?:?]
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(Unknown Source) ~[?:?]
at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source) ~[?:?]
at java.base/java.util.stream.ReferencePipeline.forEach(Unknown Source) ~[?:?]
at org.graylog.plugins.securityapp.sigma.SigmaRuleStatusSyncService.syncSigmaRuleEventStatus(SigmaRuleStatusSyncService.java:60) ~[?:?]
at org.graylog.plugins.securityapp.sigma.SigmaRuleStatusSyncPeriodical.doRun(SigmaRuleStatusSyncPeriodical.java:72) ~[?:?]
at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:99) [graylog.jar:?]
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]
at java.base/java.util.concurrent.FutureTask.runAndReset(Unknown Source) [?:?]
at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) [?:?]
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
at java.base/java.lang.Thread.run(Unknown Source) [?:?]
```
## Possible Solution
unknow
## Steps to Reproduce (for bugs)
1. install graylog security licence
2. create sigma rule with custom event definition
3. uninstall graylog security licence
## Context
It's a testing environment for exploring Graylog feature like Graylog Security but i want to uninstall it now.
I tried de find this event but it's not exist in the traditionnal menu (Alerts > Event Definitions).
## Your Environment
3 node Graylog, 5 nodes opensearch.
* Graylog Version: 6.0.3+eb761c5
* Java Version: 17.0.12
* OpenSearch Version: 2.11.1
* MongoDB Version: 6.0.16
* Operating System: Rocky Linux release 8.10 (Green Obsidian)
* Browser version: Firefox 129.0.1
Contributor guide
Assessment
This issue has not been assessed yet.