Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
38 lines
1.5 KiB
Markdown
38 lines
1.5 KiB
Markdown
# Support
|
|
|
|
**English** · [Português](pt-BR/suporte.md)
|
|
|
|
Acauã is distributed as a containerized NDR engine. The fastest way to get help
|
|
is opening an issue in the Gitea repository.
|
|
|
|
## Before opening an issue
|
|
|
|
1. Run `acaua doctor --json` inside the container (`docker exec acaua acaua doctor --json`) or host.
|
|
2. Confirm the version with `acaua --version`.
|
|
3. Try reproducing with the smallest possible Zeek log capture.
|
|
4. Review the [known limits](../README.md#known-limits) and [architecture](architecture.md).
|
|
|
|
## What to include
|
|
|
|
- Host operating system, architecture (`uname -m`) and Acauã version/tag.
|
|
- The exact command or Docker Compose definition.
|
|
- Full container logs (`docker compose logs acaua`).
|
|
- Redacted Zeek log samples demonstrating the issue.
|
|
|
|
Do not attach production captures or credentials. Redact IP addresses, hostnames
|
|
and sensitive payloads before sharing.
|
|
|
|
## Security issues
|
|
|
|
Do not include exploit details in a public issue. Follow
|
|
[SECURITY.md](../SECURITY.md) and request a private communication channel.
|
|
|
|
## Common situations
|
|
|
|
| Symptom | What to check |
|
|
|---|---|
|
|
| Container fails to start | Confirm `libduckdb.so` linkage via `docker logs` and verify permissions on named volumes |
|
|
| `serve` is unreachable from another host | Service binds to loopback (`127.0.0.1:8787`) by default; verify reverse proxy configuration |
|
|
| `update` fails | Check network connectivity to Gitea Releases API or verify registry pull permissions |
|
|
| Web UI shows Portuguese | `Auto` follows the browser language; select English in settings |
|