[Bug] Attachment stored in thehive but not in configured file-storage

[crackytsi]

Bug / Feature Request

Work Environment

Question	Answer
OS version (server)	Debian
OS version (client)	10
TheHive version / git hash	4 RC1
Package Type	DEB

Problem Description

Attachmend is stored in thehive, but not in the configured file-storage

Steps to Reproduce

1. configure local filesystem storage.
2. add an attachment to a log message
3. check if the file is locally stored or if the directory is still empty.

[To-om]

Can you paste the storage related configuration ?

[crackytsi]

Hi,
My configuration in file /etc/thehive/application.conf is:

## Attachment storage configuration
storage {
  ## Local filesystem
  provider: localfs
  localfs.directory: /opt/thp_data/files/thehive

  ## Hadoop filesystem (HDFS)
  #// provider: hdfs
  #// hdfs {
  #//   root: "hdfs://localhost:10000" # namenode server hostname
  #//   location: "/thehive"           # location inside HDFS
  #//   username: thehive              # file owner
  #// }
}

I had some confusions, as the document:
https://github.com/TheHive-Project/TheHiveDocs/blob/master/TheHive4/Installation/Install_deb.md#install-from-repository
says:

To use Cassandra database, TheHive configuration file (/etc/thehive/conf/application.conf) has to be edited

As this file does not exist, and for that made no sense to create, I used the existing.
Is this the reason?
Maybe we should also document, that what happens if the storage-provider section can't be found.

Is there a way to query cassandra/janusgraph for my attachment?

[To-om]

It is a documentation issue (I've just fixed it). The correct parameter is localfs.location.
Attachment are not stored in database (Cassandra).

[crackytsi]

@To-om Thank for your support. But can you tell me where exactly my attachment is now stored? And what is the migration path? Can I just change that? Is there any way to migrate it from the current place (wherever it is) to the new place?

[ptobis]

@To-om Could you please fix Install_binaries.md and Install_rpm.md as well? These documents contain localfs.directory instead of localfs.location as well.

[ptobis]

@crackytsi You need to move contents of /tmp/scalligraph to a location that you've defined in localfs.location.

[crackytsi]

@ptobis : Thanks a lot, you helped me :)
@To-om: Please note the the path is still wrong in the documents.
It says:

/etc/thehive/conf/application.conf
But correct would be:
/etc/thehive/application.conf

[crackytsi]

I created pull requests, sorry, for making 3 pull requests instead of one, I'm not experienced editing files directly in github...

[Krypterya]

Updating this issue as it seems to be the most relevant place to do so.
Please let me know should you prefer that I create a new issue for this.

In the RPM package, the default configuration file of TheHive has the wrong key for "localfs."

Value in default conf file:

localfs.directory

Value that works:

localfs.location

RPM Package should be updated to reflect the correct key entry.