Systemd: thehive.service: Failed with result 'exit-code'.

[faustus25]

Attempting to run thehive.service from systemd fails, issue described below:

Request Type

Bug/misconfiguration

Work Environment

Question	Answer
OS version (server)	Ubuntu
TheHive version / git hash	thehive-3.1.2-1
Package Type	From source

Problem Description

service thehive status
â thehive.service - TheHive
Loaded: loaded (/usr/lib/systemd/system/thehive.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Mon 2018-12-03 ; 5min ago
Docs: https://thehive-project.org
Main PID: 1135 (code=exited, status=255)

server01 systemd[1]: Started TheHive.
server01 systemd[1]: thehive.service: Main process exited, code=exited, status=255/n/a
server01 systemd[1]: thehive.service: Unit entered failed state.
server01 systemd[1]: thehive.service: Failed with result 'exit-code'.

Steps to Reproduce

sudo addgroup thehive
sudo adduser --system thehive
sudo cp /opt/thehive/package/thehive.service /usr/lib/systemd/system
sudo chown -R thehive:thehive /opt/thehive
sudo chgrp thehive /etc/thehive/application.conf
sudo chmod 640 /etc/thehive/application.conf
sudo systemctl enable thehive
sudo service thehive start

Possible Solutions

#29
Applied:

-Dpidfile.path=/opt/thehive/RUNNING_PID

Complementary information

/usr/lib/systemd/system/thehive.service

[Unit]
Description=TheHive
Documentation=https://thehive-project.org
Wants=network-online.target
After=network-online.target

[Service]
WorkingDirectory=/opt/thehive

User=thehive
Group=thehive

ExecStart=/opt/thehive/bin/thehive \
        -Dconfig.file=/etc/thehive/application.conf \
        -Dlogger.file=/etc/thehive/logback.xml \
        -Dpidfile.path=/dev/null

StandardOutput=null
StandardError=null

# Specifies the maximum file descriptor number that can be opened by this process
LimitNOFILE=65536

# Disable timeout logic and wait until process is stopped
TimeoutStopSec=0

# SIGTERM signal is used to stop the Java process
KillSignal=SIGTERM

# Java process is never killed
SendSIGKILL=no

# When a JVM receives a SIGTERM signal it exits with code 143
SuccessExitStatus=143

[Install]
WantedBy=multi-user.target

[To-om]

Have you identified why TheHive service doesn't start ?

I don't recommend to configure a PID file as it is not useful (it is managed by systemd) and prevent the service startup if it has been removed at the last service stop.

[faustus25]

No, I copied the original thehive.service to systemd/system, restarted the server and it did not run.
Modified as "-Dpidfile.path=/opt/thehive/RUNNING_PID" , restarted the server and it did not run.

What is the best way to check this?

[InsanesTheName]

I had this same error just now ... running

/opt/thehive/bin/thehive \
    -Dconfig.file=/etc/thehive/application.conf \
    -Dlogger.file=/etc/thehive/logback.xml \
    -Dpidfile.path=/dev/null

revealed that the service didn't have permission to write to the log directory (/var/log/thehive).

Perhaps the following commands should be added to the service configuration documentation?

sudo chown -R thehive:thehive /var/log/thehive
sudo chmod -R 644 /var/log/thehive

[faustus25]

Updated the folder owner and permissions (were assigned to root) but owned by thehive user now.

Same issue post reboot:

systemd[1]: Started TheHive.
systemd[1]: thehive.service: Main process exited, code=exited, status=255/n/a
systemd[1]: thehive.service: Unit entered failed state.
systemd[1]: thehive.service: Failed with result 'exit-code'.

Permissions for systemd files below, is worth changing to run under user context?:

ls -l /usr/lib/systemd/system/
total 12
-rw-r--r-- 1 root root   cortex.service
-rw-r--r-- 1 root root  elasticsearch.service
-rw-r--r-- 1 root root   thehive.service
````

[faustus25]

Figured out the issue, the install guide for TheHive needs to include the following if using systemd to run thehive.service as it is missing in the specified path as described in /usr/lib/systemd/system/thehive.service

cp -r /opt/thehive/conf/logback.xml /etc/thehive