CDQR Parsing when Timesketch Elastic Search Not running about cdqr

[orlikoski]

That is interesting. Are you sure it's not due to elasticsearch not running?

…

On Fri, Apr 13, 2018, 8:13 AM Daniel Chun ***@***.***> wrote: I've been running into problems where CDQR.py is throwing errors when timesketch is not running. @chunderstruck <https://github.com/chunderstruck> will look into this issue and submit a pull request. Removing uncompressed files in directory: Results/artifacts/ Process to export to ElasticSearch started Exporting results in TimeSketch format to the ElasticSearch server "psort.py" "-o" "timesketch" "--status_view" "linear" "--name" "bumblebee" "--index" "bumblebee" "Results/BUMBLEBEE.plaso" ERROR: There was a problem. See details in log. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#21>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AI9CHEJ6aLov-q2g-6AQ8XJDJ9vNcybaks5toKR1gaJpZM4TTbXE> .

[chunderstruck]

Either Elastic or Timesketch wasn't working, it was resolved when I restarted timesketch.

I've run into this issue a couple times when testing new builds...

[orlikoski]

I wonder what is causing ElasticSearch to not start up intermittently. If the RAM in Skadi is too low (less than 8GB) I know there is a chance for that to happen.

It's easy to tell if that's the issue. sudo systemctl status elasticsearch should have a message with a memory error/warning if that's the case

[orlikoski]

This doesn't appear to be an issue with the latest version. Closing