Lucas RayanandClaude Sonnet 5
8a80504c45
Release / Plan (reuse the published image?) (push) Successful in 3s
CI / Docker image (build and smoke test) (push) Skipped
CI / Format and clippy (push) Successful in 4m32s
CI / Dependency audit (push) Successful in 11s
CI / Tests (Linux) (push) Successful in 9m15s
Release / ci (push) Successful in 9m18s
Release / Build image (arm64) (push) Failing after 7m7s
Release / Build image (amd64) (push) Failing after 13m53s
Release / Publish tags (push) Skipped
Release / Gitea release (push) Skipped
Acaua is a collective SOC daemon consuming only Zeek log files, not a single-user tool needing local hardware like its siblings. Drop the Tauri desktop shell, installers and self-update entirely; the server and its web dashboard ship as a container, updated by pulling a new image tag. Link against the official prebuilt libduckdb instead of compiling it from source via the bundled feature, cutting image build time from 15+ minutes to about 3. Fix a real bug found along the way: as PID 1 in a container, the daemon ignored SIGTERM and was always killed after the stop timeout; it now shuts down gracefully. Also corrects the Pillar 1 beaconing score: the period estimate had a harmonic alias (a perfectly periodic 4h series resolved to 600s), and the old score formula flagged pure random traffic as suspicious (p95 = 0.839 on Poisson noise). The new formula was validated against 300 samples per scenario. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VAyr8d7HuAdUGB6aA5xmDD
1.5 KiB
1.5 KiB
Support
English · Português
Acauã is distributed as a containerized NDR engine. The fastest way to get help is opening an issue in the Gitea repository.
Before opening an issue
- Run
acaua doctor --jsoninside the container (docker exec acaua acaua doctor --json) or host. - Confirm the version with
acaua --version. - Try reproducing with the smallest possible Zeek log capture.
- Review the known limits and architecture.
What to include
- Host operating system, architecture (
uname -m) and Acauã version/tag. - The exact command or Docker Compose definition.
- Full container logs (
docker compose logs acaua). - Redacted Zeek log samples demonstrating the issue.
Do not attach production captures or credentials. Redact IP addresses, hostnames and sensitive payloads before sharing.
Security issues
Do not include exploit details in a public issue. Follow SECURITY.md and request a private communication channel.
Common situations
| Symptom | What to check |
|---|---|
| Container fails to start | Confirm libduckdb.so linkage via docker logs and verify permissions on named volumes |
serve is unreachable from another host |
Service binds to loopback (127.0.0.1:8787) by default; verify reverse proxy configuration |
update fails |
Check network connectivity to Gitea Releases API or verify registry pull permissions |
| Web UI shows Portuguese | Auto follows the browser language; select English in settings |