mirror of
https://github.com/overcuriousity/autopsy-flatpak.git
synced 2025-07-06 21:00:22 +00:00
New troubleshooting page
This commit is contained in:
parent
72069637dc
commit
dfcd433c2b
BIN
docs/doxygen-user/images/troubleshooting_log_menu.png
Normal file
BIN
docs/doxygen-user/images/troubleshooting_log_menu.png
Normal file
Binary file not shown.
After Width: | Height: | Size: 16 KiB |
BIN
docs/doxygen-user/images/troubleshooting_thread.png
Normal file
BIN
docs/doxygen-user/images/troubleshooting_thread.png
Normal file
Binary file not shown.
After Width: | Height: | Size: 31 KiB |
@ -98,6 +98,7 @@ The following topics are available here:
|
||||
- \subpage translations_page
|
||||
- \subpage update_interesting_files_page
|
||||
|
||||
- \subpage troubleshooting_page
|
||||
|
||||
If the topic you need is not listed, then you can:
|
||||
- Refer to the <a href="http://wiki.sleuthkit.org/index.php?title=Autopsy_User%27s_Guide">Autopsy Wiki</a>
|
||||
|
90
docs/doxygen-user/troubleshooting.dox
Normal file
90
docs/doxygen-user/troubleshooting.dox
Normal file
@ -0,0 +1,90 @@
|
||||
/*! \page troubleshooting_page Troubleshooting
|
||||
|
||||
If you are experiencing an error, we encourage you to post on the forum (https://sleuthkit.discourse.group/), including as much information as possible:
|
||||
<ul>
|
||||
<li>Your operating system and version of Autopsy
|
||||
<li>What led to the error. For example:
|
||||
<ul>
|
||||
<li>What type of data source was being processed?
|
||||
<li>Which ingest modules were running?
|
||||
<li>Which specialized viewer were you using?
|
||||
</ul>
|
||||
<li>The error being displayed on screen (if applicable)
|
||||
<li>If there were any errors in the \ref troubleshooting_logs "logs"
|
||||
</ul>
|
||||
|
||||
\section troubleshooting_logs Viewing the Logs
|
||||
|
||||
The logs are generally the most helpful in figuring out why an error is occurring. There are two sets of logs - the system logs and the case logs. There is an option in the UI to open the log folder:
|
||||
|
||||
\image html troubleshooting_log_menu.png
|
||||
|
||||
If you have a case open, clicking this will open the folder containing the case logs. If not, it will open the system log folder. You can also browse to these folders normally:
|
||||
<ul>
|
||||
<li> Case logs: (case folder)\\Logs
|
||||
<li>System logs: C:\\Users\\(user name)\\AppData\\Roaming\\autopsy\\var\\log (on Windows)
|
||||
</ul>
|
||||
|
||||
In either case, the log of interest is most likely "autopsy.log.0", although it could be one of the older versions if you've closed and reopened Autopsy since the error occurred. You're looking for entries starting with "SEVERE" and possibly "WARNING" if there are no severe errors. Note that it's not unusual to have many warnings in the log. This is an example of a severe error with a stack trace:
|
||||
|
||||
\verbatim
|
||||
Sep 23, 2020 9:48:24 AM org.sleuthkit.autopsy.casemodule.services.TagNameDefinition saveToCase
|
||||
SEVERE: Error saving tag name definition
|
||||
org.sleuthkit.datamodel.TskCoreException: Error adding row for Follow Up tag name to tag_names table
|
||||
at org.sleuthkit.datamodel.SleuthkitCase.addOrUpdateTagName(SleuthkitCase.java:9846)
|
||||
at org.sleuthkit.autopsy.casemodule.services.TagNameDefinition.saveToCase(TagNameDefinition.java:239)
|
||||
at org.sleuthkit.autopsy.casemodule.services.TagsManager.<init>(TagsManager.java:288)
|
||||
at org.sleuthkit.autopsy.casemodule.services.Services.<init>(Services.java:50)
|
||||
at org.sleuthkit.autopsy.casemodule.Case.openCaseLevelServices(Case.java:2480)
|
||||
at org.sleuthkit.autopsy.casemodule.Case.open(Case.java:1993)
|
||||
at org.sleuthkit.autopsy.casemodule.Case.lambda$doOpenCaseAction$6(Case.java:1863)
|
||||
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
|
||||
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
|
||||
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
|
||||
at java.lang.Thread.run(Thread.java:748)
|
||||
Caused by: java.sql.SQLException: ResultSet closed
|
||||
at org.sqlite.core.CoreResultSet.checkOpen(CoreResultSet.java:76)
|
||||
at org.sqlite.jdbc3.JDBC3ResultSet.findColumn(JDBC3ResultSet.java:39)
|
||||
at org.sqlite.jdbc3.JDBC3ResultSet.getLong(JDBC3ResultSet.java:422)
|
||||
at com.mchange.v2.c3p0.impl.NewProxyResultSet.getLong(NewProxyResultSet.java:424)
|
||||
at org.sleuthkit.datamodel.SleuthkitCase.addOrUpdateTagName(SleuthkitCase.java:9843)
|
||||
... 10 more
|
||||
\endverbatim
|
||||
|
||||
If the error message doesn't help you solve the problem yourself, please post to the <a href="https://sleuthkit.discourse.group/">forum</a> including the full stack trace (if available).
|
||||
|
||||
\section troubleshooting_stack Creating a Thread Dump
|
||||
|
||||
You can also generate a thread dump of the current state. This is useful if an ingest module or other process seems to be stuck. To generate a thread dump, go to "Help" then "Thread Dump" in the UI.
|
||||
|
||||
\image html troubleshooting_thread.png
|
||||
|
||||
You'll then see a file similar to this in a text viewer:
|
||||
|
||||
\verbatim"Module-Actions" Id=222 RUNNABLE
|
||||
at sun.management.ThreadImpl.getThreadInfo1(Native Method)
|
||||
at sun.management.ThreadImpl.getThreadInfo(ThreadImpl.java:178)
|
||||
at org.sleuthkit.autopsy.actions.ThreadDumpAction$ThreadDumper.createThreadDump(ThreadDumpAction.java:120)
|
||||
at org.sleuthkit.autopsy.actions.ThreadDumpAction$ThreadDumper.doInBackground(ThreadDumpAction.java:91)
|
||||
at org.sleuthkit.autopsy.actions.ThreadDumpAction$ThreadDumper.doInBackground(ThreadDumpAction.java:87)
|
||||
at javax.swing.SwingWorker$1.call(SwingWorker.java:295)
|
||||
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
|
||||
at javax.swing.SwingWorker.run(SwingWorker.java:334)
|
||||
...
|
||||
|
||||
|
||||
"IM-start-ingest-jobs-0" Id=218 WAITING on java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject@7ceb341e
|
||||
at sun.misc.Unsafe.park(Native Method)
|
||||
- waiting on java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject@7ceb341e
|
||||
at java.util.concurrent.locks.LockSupport.park(LockSupport.java:175)
|
||||
at java.util.concurrent.locks.AbstractQueuedSynchronizer$ConditionObject.await(AbstractQueuedSynchronizer.java:2039)
|
||||
at java.util.concurrent.LinkedBlockingQueue.take(LinkedBlockingQueue.java:442)
|
||||
at java.util.concurrent.ThreadPoolExecutor.getTask(ThreadPoolExecutor.java:1074)
|
||||
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1134)
|
||||
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
|
||||
at java.lang.Thread.run(Thread.java:748)
|
||||
\endverbatim
|
||||
|
||||
If the thread dump says anything about a deadlock then that's the problem. Please make sure to post any deadlocks to the <a href="https://sleuthkit.discourse.group/">forum</a>. Even if not the thread dump could help diagnose your problem so consider including in your post.
|
||||
|
||||
*/
|
Loading…
x
Reference in New Issue
Block a user