google/timesketch

[timesketch-ctl] create sketch health check

Opened this issue · 0 comments

There are instances where OS had problems and we have sketches with not existing or defect OS indexes. To detect it, it would be handy to have a way in timesketch-ctl or cli-client to run over all sketches and find non existing index to report.

The admin then can either mark the sketch, try to restore from a backup or something else. Important is the first step to surface it other than Timesketch user when trying to access it (and running in an exception)