Elsa homepage not loading '/elsa-query/ not found'

[kyle.o...@gmail.com]

Hi,

I was looking to co-locate a CIF server on my security onion box this weekend but as a side effect Elsa's web root folder was disrupted. When I open https://localhost/elsa I now get the error "The requested URL /elsa-query/ was not found on this server."

I tried re-installing Elsa Web but this didn't fix it and I cannot find an 'elsa-query' folder anywhere on the file system.

Thank you for your help.

[Kevin Branch]

Do you have these lines in /etc/apache2/sites-available/securityonion.conf ?

                ProxyRequests off

                ProxyPass /elsa-query http://127.0.0.1:3154/

                ProxyPassReverse /elsa-query http://127.0.0.1:3154/

Is /etc/apache2/sites-enabled/securityonion.conf properly symlinked to /etc/apache2/sites-available/securityonion.conf ?

When you try to surf to https://localhost/elsa-query/ directly, what shows up in /var/log/apache2/error.log ?

What is the output of:

netstat -natp | grep 3154

Kevin

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.
To post to this group, send email to security-onion@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

[kyle.o...@gmail.com]

Thanks Kevin,

It looks like the process that is supposed to be listening on 3154 is not running. The netstat does not return anything. Also when I surfed locally nothing was appended to error.log.

When I run the CRON job I am getting: "Duplicate entry 'syslog_data.syslogs_index_1'... The full error is attached.

Thank you again for your help.

Kyle

[kyle.o...@gmail.com]

I opted to re-run sosetup as I wasn't losing too much by doing so and I am now able to login to ELSA but when I do I get the following error:

{"error" : "DBD::mysql::st execute failed: Unknown column 'email' in 'field_list' at /opt/elsa/web/lib/User.pm line 364.\n"}

[Kevin Branch]

It sounds like some leftovers from the broken ELSA installation are affecting you even after re-running sosetup.  I would suggest clean-slating ELSA, which blows away the ELSA archives and index tables. The command to do that is:

sudo securityonion-elsa-reset

Kevin

On Mon, Aug 8, 2016 at 5:53 PM, <kyle.o...@gmail.com> wrote:

I opted to re-run sosetup as I wasn't losing too much by doing so and I am now able to login to ELSA but when I do I get the following error:

{"error" : "DBD::mysql::st execute failed: Unknown column 'email' in 'field_list' at /opt/elsa/web/lib/User.pm line 364.\n"}

[kyle.o...@gmail.com]

That didn't solve it. I guess my next step is to bite the bullet and just run a clean install of Sec Onion at this point. Lesson learned!