Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 72 of 806  Not logged in ELOG logo
 Find |  Login |  Help 
 Full | Summary | Threaded | Hide attachments  Show only new entries    6444 Entries 
Goto page Previous  1, 2, 3 ... 71, 72, 73 ... 804, 805, 806   Next  
ID Date Icon Author Author Email Category OS ELOG Version Subject
  69293   Thu Jan 14 11:43:00 2021 Question Giuseppe Cucinottagiuseppe.cucinotta@unifi.itQuestionLinux3.1.3elog slowness

We run elog on a server to provide a logbook for our laboratory. We noticed that elog is very slow on loading pages: browser pages spend a lot of time in charging (actually one can speed the procedure refreshing the page but it is quite annoying).

I checked the server load with top and it doesn't show any abnormal CPU or memory usage. Then I ran lsof and I noticed that there are more than 200 entries related to the same elog PID and labelled with CLOSE_WAIT.

My questions are: can the slowness of my logbook be due to the presence of all these CLOSE_WAIT entries (which seems if I understood well wait for a response)? If it's the case, how can I solve this issue?

Thanks

  69291   Sun Jan 10 11:13:31 2021 Question Lahreche Abdelmadjidabdelmadjid.lahreche@yahoo.comQuestionWindows2006hidden files

Hello;

Could I make change on program only on the " elogd.cfg" ?

Or is there onother files, because I think there is hidden files ?

  69290   Fri Jan 8 15:35:35 2021 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux | Windows3.1.2Re: Parsing log files

Well, you could put the old options back to the config file, do the export, then remove them again.

But have a look at the Elog database files ZZMMDDa.log in your logbook directory, they are pure ASCII files, which are relatively simple to parse.

Hi John. The problem with using the Find-->Export method is that some of the Attributes for the older data are no longer shown on that screen because the Config file has since changed. That's why I'm contemplating somehow parsing the log files directly instead.

 

  69289   Fri Jan 8 15:28:06 2021 Reply Alan Grantagrant@winnipeg.caQuestionLinux | Windows3.1.2Re: Parsing log files

 

John wrote:

Hi Al; if I understand your situation correctly you want to access Elog db (logbooks) via another way. There are many ways depending on your knowledge, type of work needed, and ease of use. I have found that accessing whatever I need via Elog gui is satisfactory in many situations-- by simply exporting. THEN take the raw csv/xml  file and manipulte it more easily from there. There are MANY free web sites that will take your data then, and put it in still another format that you choose (usually manipulating the rows/columns to your liking or doing mail-merge type work on your data). BTW WPS (Windows Office clone) is awesome at further 'mail-merg'  techniques. THEN at that point you may have close to what you are trying to accomplish. I've also used PHP alot in this type of situation and have replicated Elog's data format for it's db (logbooks)..; so PHP is great in this maner, although of course it takes time to 'get-it-right' if you are not well versed in it. If you go into detail more of what type of format you want as the finalized product, maybe  more suggestions will be made.

Happy belated New Years everyone,

John

Alan Grant wrote:

Sometimes we change the attributes in a config file for a given tab as time goes on, which naturally can get out of sync with the older data in that tab.

I can imagine some other Elog users have encounterd this too at some point so I'm wondering if there's a utilty or some way anyone knows of that I can use to parse a log file DIRECTLY to view the older data, without using the Elog GUI?

 

Hi John. The problem with using the Find-->Export method is that some of the Attributes for the older data are no longer shown on that screen because the Config file has since changed. That's why I'm contemplating somehow parsing the log files directly instead.

  69288   Fri Jan 8 13:47:14 2021 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux3.1.3Re: Path disclosure on unfound file

Ok, I fixed the code in the current commit (395e101add19f0fe8a11a25d0822e511f34d94d1). The path gets stripped, and we see a

prinnydood wrote:

I can confirm this issue exists on version 3.1.3, which I have installed elog on Debian 10.

The issue also exists on version 3.14 (1.20190113git283534d97d5a.el7), which I tested on an AmazonLinux EC2 instance.

This is what I found:

1. if I leave out the extension at the end of the URL for a non-existent page, it gives me the red error box. So far so good... Example: /gibberish

2. if I include any random extension at the end of the URL for a non-existent page, it gives me the red error box. So far so good... Example: /gibberish.php or /gibberish.htm or /gibberish.asdfasd

3. if I include any .html extension specifically at the end of the URL for a non-existent page, elog exposes the path /usr/share/elog/themes/default/gibberish.html. This is a bug... Example: /gibberish.html exposes the path, and likewise, /.gibberish.html ( "dot" + gibberish) exposes the path

4. if I include a valid, existent .html file which is located in the directory /usr/share/elog/themes/default/, and call it, elog exposes the html document. Example: I created an html file called gibberish.html (containing <html><body><p>Hello world</p></body></html>) in my system's /usr/share/elog/themes/default/ directory. After navigating back to the /gibberish.html URL, I was presented with the HTML file.

Turning on -v (verbose mode), the response by elogd when accessing these are: "GET /elog/gibberish.html HTTP/1.0 Returned 605 bytes" (displays "Hello world" html file), and "GET /elog/gibberish.asdfasd HTTP/1.0 Returned 605 bytes" (displays red error box).

=====

My guess: the program seems to be caring about the files ONLY if they have html file extension. Please see the screenshots below.

====

What are the security implications? Not much, I think. From what I can tell, exposing the "/usr/share/themes/elog" path, and also exposing the elog version when the file does not exist. Hope this reply helps anyone else with the same question.

(I am sure the error exposing the version can be removed by editing the source code--this is probably beyond my capabilities at this point).

 

  69287   Fri Jan 8 06:14:49 2021 Entry Johnsecondcomingtechnologies@fastmail.comQuestionLinux | Windows3.1.2Re: Parsing log files

Hi Al; if I understand your situation correctly you want to access Elog db (logbooks) via another way. There are many ways depending on your knowledge, type of work needed, and ease of use. I have found that accessing whatever I need via Elog gui is satisfactory in many situations-- by simply exporting. THEN take the raw csv/xml  file and manipulte it more easily from there. There are MANY free web sites that will take your data then, and put it in still another format that you choose (usually manipulating the rows/columns to your liking or doing mail-merge type work on your data). BTW WPS (Windows Office clone) is awesome at further 'mail-merg'  techniques. THEN at that point you may have close to what you are trying to accomplish. I've also used PHP alot in this type of situation and have replicated Elog's data format for it's db (logbooks)..; so PHP is great in this maner, although of course it takes time to 'get-it-right' if you are not well versed in it. If you go into detail more of what type of format you want as the finalized product, maybe  more suggestions will be made.

Happy belated New Years everyone,

John

Alan Grant wrote:

Sometimes we change the attributes in a config file for a given tab as time goes on, which naturally can get out of sync with the older data in that tab.

I can imagine some other Elog users have encounterd this too at some point so I'm wondering if there's a utilty or some way anyone knows of that I can use to parse a log file DIRECTLY to view the older data, without using the Elog GUI?

 

  69286   Fri Jan 8 05:48:45 2021 Question Alan Grantagrant@winnipeg.caQuestionWindows3.1.2Parsing log files

Sometimes we change the attributes in a config file for a given tab as time goes on, which naturally can get out of sync with the older data in that tab.

I can imagine some other Elog users have encounterd this too at some point so I'm wondering if there's a utilty or some way anyone knows of that I can use to parse a log file DIRECTLY to view the older data, without using the Elog GUI?

  69285   Thu Dec 31 18:35:19 2020 Reply prinnydoodmoltensolderlabs@pm.meBug reportLinux3.1.3Re: Path disclosure on unfound file

I can confirm this issue exists on version 3.1.3, which I have installed elog on Debian 10.

The issue also exists on version 3.14 (1.20190113git283534d97d5a.el7), which I tested on an AmazonLinux EC2 instance.

This is what I found:

1. if I leave out the extension at the end of the URL for a non-existent page, it gives me the red error box. So far so good... Example: /gibberish

2. if I include any random extension at the end of the URL for a non-existent page, it gives me the red error box. So far so good... Example: /gibberish.php or /gibberish.htm or /gibberish.asdfasd

3. if I include any .html extension specifically at the end of the URL for a non-existent page, elog exposes the path /usr/share/elog/themes/default/gibberish.html. This is a bug... Example: /gibberish.html exposes the path, and likewise, /.gibberish.html ( "dot" + gibberish) exposes the path

4. if I include a valid, existent .html file which is located in the directory /usr/share/elog/themes/default/, and call it, elog exposes the html document. Example: I created an html file called gibberish.html (containing <html><body><p>Hello world</p></body></html>) in my system's /usr/share/elog/themes/default/ directory. After navigating back to the /gibberish.html URL, I was presented with the HTML file.

Turning on -v (verbose mode), the response by elogd when accessing these are: "GET /elog/gibberish.html HTTP/1.0 Returned 605 bytes" (displays "Hello world" html file), and "GET /elog/gibberish.asdfasd HTTP/1.0 Returned 605 bytes" (displays red error box).

=====

My guess: the program seems to be caring about the files ONLY if they have html file extension. Please see the screenshots below.

====

What are the security implications? Not much, I think. From what I can tell, exposing the "/usr/share/themes/elog" path, and also exposing the elog version when the file does not exist. Hope this reply helps anyone else with the same question.

(I am sure the error exposing the version can be removed by editing the source code--this is probably beyond my capabilities at this point).

Attachment 1: no_extension.png
no_extension.png
Attachment 2: nonexistent_html.png
nonexistent_html.png
Attachment 3: random_extension.png
random_extension.png
Attachment 4: valid_html_file_with_html_extension.png
valid_html_file_with_html_extension.png
Goto page Previous  1, 2, 3 ... 71, 72, 73 ... 804, 805, 806   Next  
ELOG V3.1.5-3fb85fa6