App Control: Agent Does Not Have an Active Yara Rules File

[#1]

Environment

• App Control Server: All Supported Versions
• App Control Agent: All Supported Versions

Symptoms

• Agents are failing Health Checks with the following message:

Carbon Black App Control Agent detected a problem: Agent does not have an active yara rules file Version[0]. Options[00000003] TotalFailures[1] FailureId[875]

Cause

• The Agent has a corrupted or missing Yara file.
• The Server's last automatic generation of the Yara package was either interrupted, or did not build correctly. Expected Yara and actual Yara no longer match.

Resolution

• If the issue is happening on a limited number of devices attempt to manually import the Yara file.
• If the issue is happening on multiple devices, or manually importing yields the error, "Missing schema version" rebuild the Yara file.

Related Content

App Control: How to Manually Import Agent Yara Rules
App Control: How to Rebuild Yara.bt9
App Control: Yara Rules Out of Date
App Control: What Are Yara Rules?