I'm seeing this error in the Gravwell GUI, how can I resolve it?
The Gravwell user interface uses html5 REST APIs for all communications except for search data, which uses a websocket. This error indicates that the user interface can communicate over those REST APIs, but not the websocket. Usually, this error occurs because of an http-proxy or VPN between the browser client and the Gravwell webserver. Not all proxy servers support websockets.
Some questions to ask:
Is the browser client connecting directly to the Gravwell Webserver?
Open the developer tools of the browser and open the Network tab.
- Are there successful xhr requests?
- Does the websocket initialization fail?
- Are there any errors in the browser console?
Remediation:
Unfortunately, if a third party device is intercepting communications between the client web browser and the Gravwell webserver, there is little that you can do aside from contacting the administrators of the device to request websocket support (which is often a checkbox in the device configuration).
Workarounds:
If you have SSH access to your Gravwell webserver, you can work around this issue by tunneling http traffic over SSH.
ssh -L 7777:127.0.0.1:80 your.gravwell.address.here
Then, browse to http://127.0.0.1:7777 . This will force all of the GUI traffic through your SSH connection and bypass the third party device that is killing the websocket connection.
If you are not familiar with SSH tunneling, you can find some information here: https://linuxize.com/post/how-to-setup-ssh-tunneling/