Version
This solution applies to versions earlier than v5.1.
Issue
When using a custom feed that reaches out to an external URL, the synchronization of Feed IOCs may fail due to DNS communication problems. This results in out of date Feeds that do not have an updated list of IOCs.
Symptoms
The following message may appear in the /var/log/cb/job-runner/job-runner.log logs:
Jan 15 16:44:19 [7495] <err> [feed_sync] HTTPSConnectionPool(host='api.alliance.carbonblack.com', port=443): Max retries exceeded with url: /api/v1/feeds/?negative_scores=True (Caused by <class 'gevent.dns.DNSError'>: [Errno 67] request timed out)
The following message may also appear in the /var/log/cb/allianceclient/allianceclient.log logs:
ConnectionError: HTTPSConnectionPool(host='api.alliance.carbonblack.com', port=443): Max retries exceeded with url: /api/v1/statistics/performance (Caused by <class 'gevent.dns.DNSError'>: [Errno 67] request timed out)
Solution
On versions earlier than v5.1, update the python gevent package to 0.13.8. Note that this is a 3rd party library, and a bug with previous versions introduced the DNS lookup problems. Perform the following to update the version:
1. Stop the services:
service cb-enterprise stop
2. Install Python development headers and gcc packages using the Yum utility:
yum install python-devel-2.6.6 gcc -y
3. Install the new gevent version using the easy_install utility:
easy_install gevent
4. Start the services:
service cb-enterprise start
5. Ensure that the symptoms are no longer being observed.
Important Note(s)
Note that this new gevent version is included out of the box in v5.1. Refer to defect ENT-4190 in future release notes.
