502 Error when accessing Alerts, Dashboards, Hunt and Cases

[tsmullins]

We are receiving a 502 error when accessing Alerts, Dashboards, Hunt and Cases from the web gui. Kibana, Grafana, CyberChef, Playbook and Navigator work fine.

We have been running SO version 2.3.140 for at least a week. I did notice our 15 node on prem cluster was asking for a reboot, which I did do today.

A sudo salt-call state.highstate gives the following errors:

1. ID: wait_for_kratos
   http.wait_for_successful_query (404 Not Found)

A so-status from the manager has all services OK. The Grid page has all nodes showing good. Any thoughts on how to trouble shoot this? Or where to look next?

Thanks
Shane

[dmendez-vmw]

Try restarting your search nodes, we had the same issue today and that seemed to have fixed the issue.

[H4niz]

Hi there,
I met same problem after add timeout to /opt/so/saltstack/local/pillar/minions/soc-server_standalone.sls and restart so-soc:

kratos:
  kratoskey: '<truncated>'
  sessiontimeout: 720h

----------
          ID: wait_for_kratos
    Function: http.wait_for_successful_query
        Name: http://soc-server:4434/
      Result: False
     Comment: Statuses [200, 301, 302, 404] were not found.
		status: 0
		error: [Errno 104] Connection reset by peer
     Started: 16:37:52.384821
    Duration: 408842.32 ms
     Changes:  

How can I resolve this problem?

[dougburks]

@H4niz From #1720:

Start a new discussion instead of replying to somebody else's discussion
Please search to see if you can find similar discussions that may help you. However, in order to avoid confusion, please do NOT reply to somebody else's discussion with your own issue. Instead, please start a new discussion and in that new discussion you can provide a hyperlink to the related discussion.