Configure-Capture crashes after selecting Zeek file carving mode

[lenzc-pasco-wa]

Describe the bug
Configuring the Hedgehog sensor to use Zeek file carving crashes the configure script.

To Reproduce
Steps to reproduce the behavior:

1. Run configure-capture
2. Choose "Configure Capture"
3. Proceed through script until reaching the Zeek file carving selection.
4. Selecting any option besides "None" ends the configuration script with the below error screenshot. Selecting the custom options allows you to choose which file types to carve before it crashes.

Expected behavior
The script should allow me to configure the file carving settings along with the rest of the options that come after that point.

Screenshots and/or Logs

Malcolm Version:

• Version v24.07.0

How are you running Malcolm?

• ISO installed (on VM or dedicated hardware)
• via Docker on Linux
• via Docker on Microsoft Windows
• via Docker on macOS
• via Kubernetes (please provide platform details: e.g., on-prem K3s, Amazon AWS EKS, Microsoft Azure AKS, etc.)
• other (please describe)

Additional context
I was able to configure two other sensors before this, so it may not be a repeatable issue, but could be caused by something that could get fixed. I did cancel out of the initial configuration run, which may have caused this issue, but I'm not certain.

[mmguero]

Hmmm... the only time I've seen this error (which comes from the underlying dialog utility) is when stuff goes wonky with screen resolution: either the size of the terminal in which the dialog resides changes in the middle of when it's running, or the size of the terminal is too small, etc.

I've just tested, and this is not a problem I'm able to reproduce with the latest release: it's working for me on both the initial and when I cancel out of the initial run, as well as in subsequent runs. Can you narrow down any more as to what might be different about that terminal window in which this ran? At the very least I'd try increasing the size of the window and seeing it if works.

[lenzc-pasco-wa]

I was doing this over ssh at 1920x1080, but it still gives the same error if I connect it to my workbench at 1920x1080 and launch configure-capture from the GUI. I ended up just reimaging it.

[mmguero]

I ended up just reimaging it.

And it worked in the reimaged install?

[lenzc-pasco-wa]

Yes, it is working now after being reimaged.

[mmguero]

Weird. If you ever see it again and can figure out what precipitated it, or if I run into it, we can reopen this.