Invalid Token error causing console session to kick me out

[rferebee]

I was logged in with my local 'nagiosadmin' account this morning and the console just kicked me out. It was different behavior though, instead of locking up the page I was on and showing the yellow triangle symbol, it just completely logged me out of the console.

[cdienger]

I wasn't able to find anything unusual in the data that was provided. The next time this happens I'd be curious to see what is communicated on the backend so run this on the NLS machine:

Code: Select all

yum -y install tcpdump
tcpdump -s 0 -i any port 9200 -w output.pcap

let this run just long enough to refresh the page and get the message and then use CTRL+C to stop it and PM me the output.pcap.

[rferebee]

Do I run the output until the issue occurs or after it occurs? It's totally random, so I don't know how long I'll need to keep it running for the problem to happen.

Do I need to worry about output.pcap getting too large? Also, where does it save that file, I don't see a path?

Thank you.

[cdienger]

How frequently does the issue occur approximately?

The file will be written to the same location that the command is run. You can restrict it to remain small and keep only a few of the files. For example:

Code: Select all

nohup tcpdump -s 0 -i any host 127.0.0.1 and port 9200 -C 100 -W 20 -w output.pcap &

The above will keep the last 2 gigs of data that goes over port 9200 and host 127.0.0.1 in 20 100 MB files.

[rferebee]

It happens multiple times throughout the day. Sometimes every few minutes or once every hour.

[cdienger]

Okay. I would suggest starting the command if you notice the problem and hopefully we'll run into one of those once "every few minutes" scenarios. That said, there could be a lot of data captured even with the filters applied so there may need to be a few attempts to capture the behavior. I'd recommend removing all files after each attempt.

[rferebee]

Is there some other way I can send you the output.pcap files? The PM system is not letting me attach my ZIP file. It's about 115MBs.

[cdienger]

It would probably be best if you could open a ticket for this where the attachement sizes can be a little larger(50MB), but you can also split it down to PM it to me using the split command on the Linux command line:

Code: Select all

split -b 45000000 {file_name} {prefix}

[rferebee]

This thread can be locked. The issue won't be resolved until authentication procedure is updated by Nagios in a future update. Thank you.

[scottwilkerson]

This thread can be locked. The issue won't be resolved until authentication procedure is updated by Nagios in a future update. Thank you.

Ok

Locking thread