secubox/secubox-deb
1
0
Fork 0
mirror of https://github.com/CyberMind-FR/secubox-deb.git synced 2026-07-28 21:17:36 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
52e51b2766
secubox-deb/packages/secubox-metabolizer
History
CyberMind-FR 24000d67ea fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 
Hub + portal stayed `inactive (dead)` on real-hardware boot. The
journal error was `Failed to set up mount namespacing: /run/systemd/
unit-root/run/secubox: No such file or directory` at the NAMESPACE
step. Root cause: 96 services declare `RuntimeDirectory=secubox`
without the matching `RuntimeDirectoryPreserve=yes`. When any of them
stops (including any of the LXC-backed services that fail their
health probe and Restart=on-failure for a few cycles), systemd
removes /run/secubox on the way out. The next service with the same
RuntimeDirectory= that tries to namespace its inputs hits the gap
and falls into 226/NAMESPACE failure — Restart hammers a few times,
then the unit goes failed-permanent.

Earlier fmrelay + sentinelle units got the fix individually
(v2.12.0/v2.12.3 era). Now applied to all 96 remaining units in a
single sweep via:

  sed -i '/^RuntimeDirectory=secubox/a RuntimeDirectoryPreserve=yes' "$f"

No version bumps in changelog — `dpkg -i --force-depends` in the
live-USB slipstream picks up the new .deb regardless of version
number.
2026-05-26 09:50:22 +02:00
..
api feat(api): Add /health endpoint to 53 modules 2026-05-09 10:40:05 +02:00
debian fix(services): add RuntimeDirectoryPreserve=yes to 96 secubox-* units 2026-05-26 09:50:22 +02:00
menu.d feat(navbar): consolidate to 6 charter categories + fix dropped menu entries (closes #306) (#307) 2026-05-21 10:03:05 +02:00
nginx feat(phase9): Complete all 22 System Tools modules 2026-04-04 09:04:48 +02:00
www/metabolizer fix(web): rewrite stale /portal/login.html -> /login.html (closes #222) (#223) 2026-05-19 11:44:43 +02:00
README.md feat(phase9): Complete all 22 System Tools modules 2026-04-04 09:04:48 +02:00

README.md

SecuBox Metabolizer

Log processor and analyzer module for SecuBox-DEB.

Overview

SecuBox Metabolizer parses journalctl logs, extracts patterns, calculates statistics, and monitors log rotation across all SecuBox services.

Features

  • Pattern Detection: Automatically identifies error patterns, warnings, authentication failures, connection issues, service state changes, and security events
  • Statistics: Calculates lines per hour, error rates, and priority distribution
  • Service Aggregation: Aggregates logs from multiple SecuBox services
  • Trend Analysis: Hourly trend charts and error rate monitoring
  • Log Rotation: Monitors log file rotation status and disk usage

API Endpoints

All endpoints require JWT authentication via Authorization: Bearer <token>.

Endpoint Method Description
/health GET Health check (public)
/status GET Module status and overview
/stats GET Overall log statistics
/analyze GET Analyze logs and extract patterns
/services GET List available services
/services/{name}/stats GET Service-specific statistics
/services/{name}/logs GET Service raw logs
/patterns GET Detected patterns across services
/errors GET Recent errors and critical entries
/rotation GET Log file rotation information

Query Parameters

  • since: Time window (e.g., "1h", "6h", "24h", "7d")
  • priority: Filter by syslog priority (0-7)
  • service: Filter by service name
  • limit: Maximum entries to return
  • pattern_type: Filter patterns by type

Pattern Types

Type Description
error Error/failure messages
warning Warnings and deprecated notices
auth_failure Authentication failures
connection Connection issues
service_state Service start/stop/restart
security Security events (blocked, banned, etc.)

Installation

apt install secubox-metabolizer

Dependencies

  • secubox-core (>= 1.0)
  • python3-fastapi
  • python3-uvicorn

Systemd Service

# Status
systemctl status secubox-metabolizer

# Logs
journalctl -u secubox-metabolizer -f

# Restart
systemctl restart secubox-metabolizer

Configuration

The service runs on Unix socket /run/secubox/metabolizer.sock with nginx reverse proxy at /api/v1/metabolizer/.

Cache is stored at /var/cache/secubox/metabolizer/stats.json and refreshed every 60 seconds.

Frontend

Web UI available at /metabolizer/ with P31 Phosphor light theme featuring:

  • Overview dashboard with hourly trends and priority distribution
  • Pattern detection panel
  • Error log viewer
  • Service selector with per-service statistics
  • Log file rotation status

Author

Gerald KERMA devel@cybermind.fr CyberMind - https://cybermind.fr

License

Proprietary / ANSSI CSPN candidate