Thehive4.1.0 Issues with Lucene

[hermanmaleiane]

Request Type

Bug

Work Environment

| Question | Answer
|-------------------------- -|--------------------
| OS version (server) | CentOS 7
| TheHive version / git hash | 4.1.0-1
| Package Type | Docker
| Browser type & version | Chrome

Problem Description

When i upgrade from version 4.0.5 to 4.1.0-1 even with fresh installation i get the error '
[warn] o.t.s.u.Retry [|] An error occurs (Could not instantiate implementation: org.janusgraph.diskstorage.lucene.LuceneIndex), retrying (9)

Steps to Reproduce

1. Clone the repository on https://github.com/TheHive-Project/Docker-Templates/tree/main/docker/thehive4-cassandra
   and sudo chown -R 1000:1000 /opt/Docker-Templates/docker/thehive4-cassandra/vol/thehive/index.
2. Run the command docker-compose up
3. Check the logs docker logs thehive4

Complementary information

[nadouani]

Please share your config file

[hermanmaleiane]

db {
provider: janusgraph
janusgraph {
## Storage configuration
storage {
backend: cql
hostname: ["192.168.78.133"]
## Cassandra authentication (if configured)
username: "cassandra"
password: "cassandra"
cql {
cluster-name: thp
keyspace: thehive
read-consistency-level: ONE
write-consistency-level: ONE
}
}
## Index configuration
index {
search {
backend: lucene
directory: /opt/thp/thehive/index
}
}

}
}

storage {
provider: localfs
localfs.location: /opt/thp/thehive/data
}

play.http.parser.maxDiskBuffer: 50MB

[AliJaafar47]

Hi i had the same issue, i added a Dockerfile in order to create index and data folder and it solved my issue.
My Dockerfile :
FROM thehiveproject/thehive4:4.1.0-1
USER root
RUN mkdir -p /opt/thp/thehive/index
RUN mkdir -p /opt/thp/thehive/data
RUN chown -R thehive:thehive /opt/thp/thehive/index
RUN chown -R thehive:thehive /opt/thp/thehive/data
USER thehive

And i removed also those 2 line from docker compose :
- ./vol/thehive/data:/opt/thp/thehive/data
- ./vol/thehive/index:/opt/thp/thehive/index

[hermanmaleiane]

Thank you @AliJaafar47.
It's fixed.

[jeromeleonard]

reopen to update docker entrypoint accordingly.

[roisec]

Hi
I did all the things here, and I still have the same issue..
Any idea?

[hermanmaleiane]

Hi @roi-ironsrc!!
this problem was fixed after this version of thehive.
if you install the latest you will not find this problem. You don’t need to fix the permissions issues. Basically this issue is related to permissions when it tries to write data in that path. The ideia was to fix it directly on the image.

[roisec]

Hi @hermanmaleiane,
I am using latest version of the hive4, and still have this issue...
[error] o.t.s.u.Retry [|] An error occurs
java.lang.IllegalArgumentException: Could not instantiate implementation: org.janusgraph.diskstorage.lucene.LuceneIndex
Caused by: java.lang.reflect.InvocationTargetException: null
Caused by: java.lang.IllegalArgumentException: Cannot access or write to directory: /opt/thp/thehive/index

[hermanmaleiane]

Can you share the permissions on this directory?
You need to create a docker file to create another image ? Which OS version are you trying to install ?

[roisec]

I have deleted the docker image the folders in the host os and without using docker file, and rerun the docker-compose:
I see root permissions:
thehive@82273b4600e1:/opt/thp/thehive$ ls -l
total 0
drwxr-xr-x 2 root root 6 Aug 17 05:06 data
drwxr-xr-x 2 root root 6 Aug 17 05:06 db
drwxr-xr-x 2 root root 6 Aug 17 05:06 index

The server os version is: amazon_linux:2

[hermanmaleiane]

they can’t be root.
In this scenario thehive will not be able to write on this folder.
and if you want to change the permissions you need to create the docker file ali shared here to create another image

[roisec]

@hermanmaleiane
I succeeded to solve the issue by setting the version to 4.1.0-1 in the docker file as Ali said..
In the latest version it is not working.

[hermanmaleiane]

Cool @roi-ironsrc.
You are using an old version. But if you are comfortable it’s ok.

[roisec]

@hermanmaleiane
What if I will want to upgrade an eariler than thehive 4.1.0-1 ?
How I will solve it ?