Viewer Crash about arkime HOT 9 CLOSED

Just want to confirm I'm occasionally getting this error as well with the viewer.

fs.js:365
binding.read(fd, buffer, offset, length, position, wrapper);
^
Error: Length extends beyond buffer
at Object.fs.read (fs.js:365:11)
at /data/moloch/viewer/viewer.js:1242:10
at Object.wrapper as oncomplete

from arkime.

I've fixed several issues in 0.7.2, however the pcap may need to be reimported. I'm looking for samples of pcap that cause the issue if you can share.

from arkime.

Still seeing this with the version in git as of 02/18/13. Will try to localize to a single pcap, unfortunately this set is something like 10k pcaps.

fs.js:365
binding.read(fd, buffer, offset, length, position, wrapper);
^
Error: Length extends beyond buffer
at Object.fs.read (fs.js:365:11)
at /data/moloch/viewer/viewer.js:1241:10
at Object.wrapper as oncomplete

from arkime.

Did you reimport the pcap, or was this the old pcap?

In 0.7.3 I've added a try/catch block that hopefully will stop the crash and print out which session is having an issue.

from arkime.

I also am having issues with the viewer crashing... here is the output from the viewer log. Not sure what to make of it. I am running on Backtrack and have confirmed that I am capturing and elasticsearch is running correctly.

Express server listening on port 8005 in production mode
Tue, 26 Feb 2013 22:27:41 GMT �[1mGET�[0m �[33m/�[0m - bytes 2 ms
Admin doesn't exist
Tue, 26 Feb 2013 22:27:45 GMT �[1mGET�[0m �[33m/�[0m - bytes 5 ms
Error: failed to locate view "index"
at Function.exports.compile (/data/moloch/viewer/node_modules/express/lib/view.js:61:15)
at ServerResponse.res._render (/data/moloch/viewer/node_modules/express/lib/view.js:417:18)
at ServerResponse.res.render (/data/moloch/viewer/node_modules/express/lib/view.js:318:17)
at /data/moloch/viewer/viewer.js:240:7
at callbacks (/data/moloch/viewer/node_modules/express/lib/router/index.js:272:11)
at param (/data/moloch/viewer/node_modules/express/lib/router/index.js:246:11)
at pass (/data/moloch/viewer/node_modules/express/lib/router/index.js:253:5)
at Router._dispatch (/data/moloch/viewer/node_modules/express/lib/router/index.js:280:5)
at Object.middleware as handle
at next (/data/moloch/viewer/node_modules/connect/lib/http.js:204:15)

I have been one hell have a time trying to get this to work. Any help would be appreciated. Thank you.

from arkime.

Does /data/moloch/viewer/views/index.jade exist?
When you did an easybutton-singlehost did it warn about umask issues?
Make sure daemon can acces the files with something like
sudo -u daemon ls -l /data/moloch/viewer/views/index.jade

On Tue, Feb 26, 2013 at 5:45 PM, Tsun4mi [email protected] wrote:

I also am having issues with the viewer crashing... here is the output
from the viewer log. Not sure what to make of it. I am running on Backtrack
and have confirmed that I am capturing and elasticsearch is running
correctly.

Express server listening on port 8005 in production mode
Tue, 26 Feb 2013 22:27:41 GMT [1mGET[0m [33m/[0m - bytes 2 ms
Admin doesn't exist
Tue, 26 Feb 2013 22:27:45 GMT [1mGET[0m [33m/[0m - bytes 5 ms
Error: failed to locate view "index"
at Function.exports.compile
(/data/moloch/viewer/node_modules/express/lib/view.js:61:15)
at ServerResponse.res._render
(/data/moloch/viewer/node_modules/express/lib/view.js:417:18)
at ServerResponse.res.render
(/data/moloch/viewer/node_modules/express/lib/view.js:318:17)
at /data/moloch/viewer/viewer.js:240:7
at callbacks
(/data/moloch/viewer/node_modules/express/lib/router/index.js:272:11)
at param
(/data/moloch/viewer/node_modules/express/lib/router/index.js:246:11)
at pass
(/data/moloch/viewer/node_modules/express/lib/router/index.js:253:5)
at Router._dispatch
(/data/moloch/viewer/node_modules/express/lib/router/index.js:280:5)
at Object.middleware as handlehttp://data/moloch/viewer/node_modules/express/lib/router/index.js:45:10
at next (/data/moloch/viewer/node_modules/connect/lib/http.js:204:15)

I have been one hell have a time trying to get this to work. Any help
would be appreciated. Thank you.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/39#issuecomment-14144836
.

from arkime.

1. /data/moloch/viewer/views/index.jade does exist
2. I do not remember seeing the warnings about unmask issues when running easybutton-singlehost, but then again that is probably because I failed multiple dependencies with the various libraries I needed.
3. I ran the command and noticed that daemon doesn't have permissions to that file.

I will try add permissions to that directory and see where I end up. Will provide an update shortly.

from arkime.

Ok I think this is finally fixed in 47f5803, although the data needs to be reimported unfortunately.

from arkime.

I am sorry for slacking on my part. Once you had uploaded the fix, things went much smoothly. I was able to try out Moloch. Thank you.

from arkime.