-
Title
Reindex audit trails -
Description
Sometimes due to not disclosed reasons happens that we are in the need of reindexing audit trails. This howto documents the usage of our "internal" trail reindexing tool. Note that: Always consult with OI support first! -
Cause
Case is not determined here. Various reasons could lead to the need one wants to reindex trails. -
Resolution
Preambulum:
Always confirm with OI Support, that you really need to reindex trails. We can provide you the aforementioned script.
Notes:
- I suggest to start to test it with a smaller amount of trails, just to see if everything works as intended.
- I suggest to prepare the exact commands to your clipboard, since it requires the pam-pipeline service to be stopped. But if you prepare the commands it can mimimize the downtime of the pam-pipeline service to fragments of seconds / seconds.
- I suggest to prepare your exact filter using the --dry-run switch
- If you use the --rest-search option, then the --start and --end options won't work. You have to specify those conditions as part of the rest search expression.
- You can display a short summary of the command line options using the --help parameter.
Preparation:
Copy the script to the core-shell's area, eg. I used this command:
scp scb/reindex_failed_sessions.py root@scbf.gyu.support.balabit:/mnt/firmware/rootSteps:
- I. VERY IMPORTANT: stop the pam pipeline service with this command in the core shell:
systemctl stop pam-pipeline.service
- II push back the trails for reindexing:- Note that, by default it puts those trails back for reindex where the indexing was failed. If you want to push back every trail matching for your filter expression, you must use the --force-reindex switch.
- By default it only filter for the start and end dates, and it's default options are to do it for the last 7 day's failed trails.
- To see what would it put back to the queue for reindexing, you can use the --dry-run option.
Other option to choose which trails to reindex is to use an expression what you could use on the search interface.
eg. I wanted to reindex in my test environment the trails what was recorded with the connection policy called tsgw.
I used this command to achive this goal:
(core/master/scbf-gyu)root@scb1:~# ./reindex_failed_sessions.py --dry-run --rest-search 'q=recording.connection_policy:tsgw&start=2019-04-01'
About to submit 6 sessions for reindexing
Not overwriting session (svc-5hpG4mqhWvKjRhyWWUF3N7-tsgw-13-1), index status: INDEXED
Not overwriting session (svc-5hpG4mqhWvKjRhyWWUF3N7-tsgw-8-1), index status: INDEXED
Not overwriting session (svc-5hpG4mqhWvKjRhyWWUF3N7-tsgw-5-1), index status: INDEXED
Not overwriting session (svc-5hpG4mqhWvKjRhyWWUF3N7-tsgw-19-1), index status: INDEXED
Not overwriting session (svc-5hpG4mqhWvKjRhyWWUF3N7-tsgw-10-1), index status: INDEXED
Not overwriting session (svc-5hpG4mqhWvKjRhyWWUF3N7-tsgw-17-1), index status: INDEXED
Since, in this case the trails were indexed already, nothing failed I had to use the --force-reindex switch.
So, actually my terminal at the end looked like this:
(core/master/scbf-gyu)root@scb1:~# ./reindex_failed_sessions.py --rest-search 'q=recording.connection_policy:tsgw&start=2019-04-01' --force-reindex
About to submit 6 sessions for reindexing
{
"job_id": "90cb2b221128492a9c960a544e99c06a"
}
...
{
"job_id": "30728a2ee91748be9ef73565ee8d10be"
}
(core/master/scbf-gyu)root@scb1:~# systemctl start pam-pipeline.service
- III. As you could see from the end of my previous command: start again the pam-pipeline service with this command:
systemctl start pam-pipeline.service