graylog2-server
graylog2-server copied to clipboard
WhoisIpLookup over-reporting errors
Expected Behavior
The WHOIS data adapter should only report 1 error per lookup attempt.
Current Behavior
WHOIS lookups can be redirected many times which the data adapter handles with recursive calls to its run() method. When a lookup attempts results in an IOException (generally due to a timeout), that exception is logged and re-thrown. This means that the exception will be logged for each WHOIS server in the chain of redirects as it works its way back up the call stack.
Possible Solution
Do not re-throw IOExceptions here: https://github.com/Graylog2/graylog2-server/blob/5109d4ba74c7968e8a6958b57b571a44b405b32d/graylog2-server/src/main/java/org/graylog/plugins/threatintel/whois/ip/WhoisIpLookup.java#L129-L131