Environment
- CB Response Server: All Versions
- Clustered
- Unified View Server: All Versions
Symptoms
The '/var/log/audit/audit.log' file indicates 'non-root' user making calls to Master server. In this example 'testuser' should be 'root':
username timestamp ip_address request_method request_path result description
testuser 2020-03-17 07:50:54.982967-04:00 10.34.139.3 GET /api/info 200 OK
testuser 2020-03-17 07:50:23.925526-04:00 10.34.139.3 GET /api/info 200 OK
testuser 2020-03-17 07:49:52.866166-04:00 10.34.139.3 GET /api/info 200 OK
testuser 2020-03-17 07:49:03.794608-04:00 10.34.139.3 GET /api/info 200 OK
testuser 2020-03-17 07:48:32.736459-04:00 10.34.138.3 GET /api/info 200 OK
Cause
A 'non-root' user performed steps of adding CB Clusters to the Unified View Server.
Resolution
- As 'root', or administrative user, remove the CB Clusters from the Unified View Server
- Re-add CB Clusters to Unified View Server
a. To remove a CB Cluster from Unified View Server:
- If the Cluster Management page is not already showing, in multi-cluster mode, click the Carbon Black logo at the top left of the navigation bar.
- Click to select the cluster to delete.
- At the top of cluster details in the right pane, click Delete.
- Confirm the deletion by clicking Delete Cluster in response to the Confirmation prompt.
b. To add a CB Cluster to Unified View Server:
- Log in to Unified View using an administrator account.
- If you are viewing a single cluster through Unified View, click the browser tab for the multi-cluster view.
- If the Cluster Management page is not already showing, click the Carbon Black logo at the top left of the navigation bar. (If clicking this logo brings you to a HUD page, you are still in single-cluster view and should click on a different browser tab. There is no HUD page in Unified View.)
- In the list of clusters in the left pane, click Add Cluster.
- Complete settings in the Add Cluster dialog box
Additional Notes
- Reference Pg 21 - 22 of the Unified View User Guide to 'Add or Remove Clusters'
Related Content