nextcloud/suspicious_login

"Could not load model 143" warning flooding the logs

llucax opened this issue · 9 comments

llucax commented

I have a similar issue to #158 with model 143. I can't find a model 143 in /appdata_xxxx/suspicious_login/models/143., but there is a 144 and 145.

Using the model in the console:

$ occ suspiciouslogin:predict -v llucax 192.168.10.10 143

In ModelPersistenceService.php line 138:
                                                    
  [OCA\SuspiciousLogin\Exception\ServiceException]  
  Could not load model 143                          
                                                    

Exception trace:
  at /var/www/nextcloud/apps/suspicious_login/lib/Service/ModelPersistenceService.php:138
 OCA\SuspiciousLogin\Service\ModelPersistenceService->load() at /var/www/nextcloud/apps/suspicious_login/lib/Service/EstimatorService.php:63
 OCA\SuspiciousLogin\Service\EstimatorService->predict() at /var/www/nextcloud/apps/suspicious_login/lib/Command/Predict.php:77
 OCA\SuspiciousLogin\Command\Predict->execute() at /var/www/nextcloud/3rdparty/symfony/console/Command/Command.php:255
 Symfony\Component\Console\Command\Command->run() at /var/www/nextcloud/3rdparty/symfony/console/Application.php:1012
 Symfony\Component\Console\Application->doRunCommand() at /var/www/nextcloud/3rdparty/symfony/console/Application.php:272
 Symfony\Component\Console\Application->doRun() at /var/www/nextcloud/3rdparty/symfony/console/Application.php:148
 Symfony\Component\Console\Application->run() at /var/www/nextcloud/lib/private/Console/Application.php:215
 OC\Console\Application->run() at /var/www/nextcloud/console.php:100
 require_once() at /var/www/nextcloud/occ:11

In Root.php line 205:
                                                     
  [OCP\Files\NotFoundException]                      
  /appdata_xxxxx/suspicious_login/models/143  
                                                     

Exception trace:
  at /var/www/nextcloud/lib/private/Files/Node/Root.php:205
 OC\Files\Node\Root->get() at /var/www/nextcloud/lib/private/Files/Node/Folder.php:138
 OC\Files\Node\Folder->get() at /var/www/nextcloud/lib/private/Files/SimpleFS/SimpleFolder.php:76
 OC\Files\SimpleFS\SimpleFolder->getFile() at /var/www/nextcloud/apps/suspicious_login/lib/Service/ModelPersistenceService.php:135
 OCA\SuspiciousLogin\Service\ModelPersistenceService->load() at /var/www/nextcloud/apps/suspicious_login/lib/Service/EstimatorService.php:63
 OCA\SuspiciousLogin\Service\EstimatorService->predict() at /var/www/nextcloud/apps/suspicious_login/lib/Command/Predict.php:77
 OCA\SuspiciousLogin\Command\Predict->execute() at /var/www/nextcloud/3rdparty/symfony/console/Command/Command.php:255
 Symfony\Component\Console\Command\Command->run() at /var/www/nextcloud/3rdparty/symfony/console/Application.php:1012
 Symfony\Component\Console\Application->doRunCommand() at /var/www/nextcloud/3rdparty/symfony/console/Application.php:272
 Symfony\Component\Console\Application->doRun() at /var/www/nextcloud/3rdparty/symfony/console/Application.php:148
 Symfony\Component\Console\Application->run() at /var/www/nextcloud/lib/private/Console/Application.php:215
 OC\Console\Application->run() at /var/www/nextcloud/console.php:100
 require_once() at /var/www/nextcloud/occ:11

suspiciouslogin:predict [--v6] [--] <uid> <ip> [<model>]

(the xxxxxx is the masked ID, not sure if it would be a security or privacy issue if I share it)

I had some out of space issues just a few days ago, and I have the suspicion (pun intended) that it might have happened that the model had to be created in the disk but couldn't because of the lack of space (inodes in reality).

Could this have happened? And if so, would it be OK to remove the model from the DB (from table suspicious_login_model, something else?) or to just copy another model file as a hack? Or the non-existence of that file is normal and I should wait 60 days and that should be all?

In any case is not ideal to have the logs flooded with a warning that is not really a warning if it's expected behavior, so in any case I think there is something that can be improved here.

ChristophWurst commented

You should be able to resolve this with occ suspiciouslogin:train

ChristophWurst commented

think there is something that can be improved here.

suspicious_login/lib/Service/ModelPersistenceService.php

Lines 171 to 186 in 75cf213

$this->modelMapper->insert($model);
try {
$modelsFolder = $this->appData->getFolder(self::APPDATA_MODELS_FOLDER);
} catch (NotFoundException $e) {
$this->logger->info("App data models folder does not exist. Creating it");
$modelsFolder = $this->appData->newFolder(self::APPDATA_MODELS_FOLDER);
}
$modelFile = $modelsFolder->newFile((string)$model->getId());
// Inefficient, but we can't get the real path from app data as it might
// not be a local file
$tmpFile = $this->tempManager->getTemporaryFile();
$this->modelManager->saveToFile($estimator, $tmpFile);
$modelFile->putContent(file_get_contents($tmpFile));
inserts the database row and then saves the file to storage. The order is important because the ID is used for the file name. But I guess the error handling is missing and a model that can't be saved to storage should be cleared from the database.

llucax commented

You should be able to resolve this with occ suspiciouslogin:train

Unfortunately the train didn't seem to help, at least when using predict from the CLI is still throwing the error:

$ occ suspiciouslogin:train
Using ipv4 strategy
Prescision(y): 0.99019607843137
Prescision(n): 1
Recall(y): 1
Recall(n): 0.99009900990099
$ ncc suspiciouslogin:predict luca 192.12.12.12 143

In ModelPersistenceService.php line 138:
                            
  Could not load model 143  
                            

In Root.php line 205:
                                                     
  /appdata_xxxxx/suspicious_login/models/143  
                                                     

suspiciouslogin:predict [--v6] [--] <uid> <ip> [<model>]

But I guess the error handling is missing and a model that can't be saved to storage should be cleared from the database.

I see, so it is a possible scenario that the out of space error leaded to this situation. I hope some error handling can be added sooner than later :)

ChristophWurst commented

Try ncc suspiciouslogin:predict luca 192.12.12.12. Model 143 doesn't work but the app will always take the latest model available anyway.

llucax commented

OK, that didn't show any errors, but I'm not sure if it would have shown any errors before the train either :)

I checked the DB and model 143 is still there, and there is no 143 file in appdata_xxxxx/suspicious_login/models/143 (but there is a new file 146. I will keep monitoring the logs to see if the error is really gone.

BTW, and sorry if it is a silly question but, if only the last model is used (in my case 146 I guess), are the previous models removed at some point or are they used to get the new models? Will models accumulate indefinitely?

Thanks!

ChristophWurst commented

BTW, and sorry if it is a silly question but, if only the last model is used (in my case 146 I guess), are the previous models removed at some point or are they used to get the new models? Will models accumulate indefinitely?

Known unresolved enhancement: #51

  • 👍1
Githopp192 commented

same issue here, with NC 20.0.1

did the upgrade yesterday from NC 19.0.6 .. got Internal Server Error and could not login again.
Then i had to rebuild the "Instanceid" .. when doing that, the appdata_xxxx Folder will also being rebuilt.

Since then there is the following error:

[suspicious_login] Fatal: Could not load classifier model 561: /appdata_ocxxxxx/suspicious_login/models

REPORT /remote.php/dav/addressbooks/users/xxxxx/contacts/
from 1xxxxxxx by xxxxx at 2021-04-15T11:07:42+02:00

Since then i have got this error

running command:

occ suspiciouslogin:predict xxxx xxx.xxx.xxx.xxx

In ModelStore.php line 135:

Could not load model 561

In Root.php line 205:

/appdata_ocxxxxxxxx/suspicious_login/models

  • 👍1
ChristophWurst commented

I checked the DB and model 143 is still there, and there is no 143 file in appdata_xxxxx/suspicious_login/models/143 (but there is a new file 146. I will keep monitoring the logs to see if the error is really gone.

@Githopp192 is that also the case for you – the file doesn't exist, right?