Run Snorby jobs on demand...

[Heine Lysemose]

Hi

How do I run the Snorby jobs on demand from a shell?

When I try rails c, as stated on the github page for Snorby, it says that rails isn't installed.

I would like to execute the geoip job to see if I get the pretty flags back on the event page!

/Lysemose

[Doug Burks]

Hi Lysemose,

I'm not in front of a computer right now, but have you tried the following?
bundle exec rails c

Thanks,
Doug

--
Doug Burks | http://securityonion.blogspot.com
Don't miss SANS SEC503 Intrusion Detection In-Depth in
Augusta GA 6/11 - 6/16 | 10% discount for ISSA Members!
http://augusta.issa.org/drupal/SANS-Augusta-2012

[Heine Lysemose]

Hi Doug

When I'm doing bundle exec rails c from the Snorby directory I get this message

/usr/local/share/snorby$ bundle exec rails c

/usr/local/share/snorby/config/application.rb:31:in `<module:Snorby>': undefined method `symbolize_keys' for nil:NilClass (NoMethodError)

        from /usr/local/share/snorby/config/application.rb:13:in `<top (required)>'

        from /usr/local/share/snorby/vendor/bundle/ruby/1.9.1/gems/railties-3.1.0/lib/rails/commands.rb:38:in `require'

        from /usr/local/share/snorby/vendor/bundle/ruby/1.9.1/gems/railties-3.1.0/lib/rails/commands.rb:38:in `<top (required)>'

        from script/rails:6:in `require'

        from script/rails:6:in `<main>'

Thanks,

Lysemose

[Dustin Webber]

That looks like a format issue in database.yml or the snorby_config.yml.

[Doug Burks]

Good call, Dustin! The only environment we define in
snorby_config.yml is production.

Lysemose, please try this to set production mode:
RAILS_ENV=production bundle exec rails c

Thanks,
Doug

--

[Heine Lysemose]

Thanks guys, worked like a charm!

I ran these two commands and got my GeoIP cache updated 

sudo RAILS_ENV=production bundle exec rails c

Snorby::Jobs::GeoipUpdatedbJob.new(true).perform

It could be a nice feature to be able to run these scheduled jobs on demand from the website, just like the cache job. Dustin?

Thanks,

Lysemose

[Doug Burks]

Hi Hushang,

Are you running the current Security Onion 12.04 with the latest Snorby package?

Are you sure you have Internet access?

Are you sure you're running the proper commands? Looks like you're
missing a "d":
Snorby::Jobs::GeoipUpdatebJob.new(true).perform

should be:
Snorby::Jobs::GeoipUpdatedbJob.new(true).perform

Please see:
https://code.google.com/p/security-onion/wiki/FAQ#Why_isn't_Snorby_showing_GeoIP_data_properly?

Thanks,
Doug

On Thu, May 16, 2013 at 3:28 PM, Hushang A <husha...@gmail.com> wrote:

> When I try all of the following for the GeIP cache update I run the following two commands as root:

>
> RAILS_ENV=production bundle exec rails c

> Snorby::Jobs::GeoipUpdatebJob.new(true).perform
>
> When running the last command I get the following error:
>
> irb(main):001:0> Snorby::Jobs::GeoipUpdatedbJob.new(true).perform
> => #<Delayed::Backend::DataMapper::Job @id=45 @priority=1 @attempts=0 @handler="--- !ruby/struct:Snorby::Jobs::GeoipUpdatedbJob \nverbose: false\n" @run_at=Thu, 23 May 2013 19:28:12 +0000 @locked_at=nil @locked_by=nil @failed_at=nil @last_error=nil>
>
> --
> You received this message because you are subscribed to the Google Groups "security-onion" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to security-onio...@googlegroups.com.
> To post to this group, send email to securit...@googlegroups.com.
> Visit this group at http://groups.google.com/group/security-onion?hl=en-US.
> For more options, visit https://groups.google.com/groups/opt_out.