[BUG] Visualization fails for O365 Active Directory

[jebofponderworthy]

Describe the bug

I have O365 Active Directory integration set up for three different instances installed from the ISO and fully updated via the 9090 console, and in all of them, the visualization "O365 AD Successful Login Location" shows "Error running chart".

To Reproduce

1. Set up UTMStack against an Office 365 tenant.
2. Once O365 has begun to populate, click on Dashboards, O365 Overview.
3. The same thing shows in Dashboards, O365 AD Successful Login Location.

Expected behavior

No errors, and a chart :-)

Screenshots

Environment

• OS: Ubuntu 22.04 off the provided ISO, in the last week
• Browser: All

[c3s4rfred]

Hi, we will move this to discussion until we verify that it's a bug.

[c3s4rfred]

Hi, can you provide more information about the error, press F12 and send a picture of the console tab, also go to network tab and check if wich services are failing, if it is the case, select the failing service and send a picture of the errors if you can. The failing visualization should be inside a service called 'run', the errors should appear in X-UtmStack-error response header. After selected, you can verify if you are in the correct failing service by checking the value of the name field in the payload.

Best regards,

[jebofponderworthy]

I'm sure you have the right rabbit-trail. Is this F12 readout helpful? Or shall I rearrange somehow?

And you are right on about a service:

Internet connection from the device works AOK, and obviously LAN tranffic is fine. I noticed this, tried lots of things, am curious about a resolution!

[c3s4rfred]

I'm sure you have the right rabbit-trail. Is this F12 readout helpful? Or shall I rearrange somehow?

And you are right on about a service:

Internet connection from the device works AOK, and obviously LAN tranffic is fine. I noticed this, tried lots of things, am curious about a resolution!

Hi, we need the F12 (Network tab) picture, here you're showing the elements tab. See the comment that we said before.

[jebofponderworthy]

Thought conceivably it might help: I am running the UTMStack stock Ubuntu ISO as a ProxMox virtual guest. Nothing unusual though, I don't think.

[bremic9188]

I am having same issue. Looking at application logs, it looks like it's related to not being able to find the utm-geoip index.

UtmVisualizationResource.run: ResponseParserForCoordinateMapChart.parse: IpInfoServicegetIpV4Info: ElasticsearchService.search: OpenSearch.search: Request failed: [index_not_found_exception] no such index [.utm-geoip]

[c3s4rfred]

This error comes because during to network issues or installations without the required system requirements, the geoip index is not generated, then the visualization fails. We are testing ways to recreate the index without have to reinstall the instance, we will let you know.

Best regards

[c3s4rfred]

Hi @jebofponderworthy, thanks for the feedback, we verified that it is a bug, we're working on a fix. We will tell you when fixed.

Best regards

[karlbrown87]

Hi @jebofponderworthy,

To resolve this issue, you can download the latest OpenSearch container image using the following command:

docker pull ghcr.io/utmstack/utmstack/opensearch:v10

Then, stop the OpenSearch container:

docker stop containerID

Wait for the service to start the new container, and check that port 9200 is open on the OpenSearch service by running:

curl http://127.0.0.1:9200

If everything is working fine up to this point, you can proceed to create the utm_geoip repository and restore the index. You can run the following commands either from the bash console or inside the OpenSearch container:

curl -X POST "http://localhost:9200/_snapshot/.utm_geoip" -H 'Content-Type: application/json' -d '{
  "type": "fs",
  "settings": {
    "location": "/usr/share/opensearch/.utm_geoip",
    "compress": true
  }
}'

curl -X POST "http://localhost:9200/_snapshot/.utm_geoip/.utm_geoip/_restore?pretty" -H "Content-Type: application/json" -d '{
  "indices": ".utm-geoip",
  "include_global_state": false
}'

You can check that the index has been restored in your environment by running the following command:

curl -X GET "http://localhost:9200/_cat/indices?v

The index name is .utm-geoip and it should be approximately 600 MB in size. Wait a few minutes after the restore before checking if the index exists.

Once you have verified that the index exists, stop the backend service and wait a few minutes while the new backend service is created. At this point, you can check the UTMStack Dashboard to see if you can access the GEOIP visualizations.

Let me know if you encounter any issues.

Best regards,
Carlos

[karlbrown87]

Hi @jebofponderworthy,

Another viable solution could be updating to the latest version of UTMStack, as it includes significant improvements and already addresses the GeoIP index issue.

Below are the release notes for v10.6.2-202503131118, which include this bug fix:

UTMStack 10.6.2 Release Notes

Bug Fixes:

• The Log Explorer UI has been enhanced to improve usability by refining the display of Refresh, Save Query, Load Query, and Add Filter actions, providing a more intuitive user experience.

• The installer has been updated to resolve the issue with the missing GeoIP index.

• Docker images have been retagged to the GitHub Registry.

Best Regards,
Carlos