EDR: No threat report for yara feed

[#1]

Environment

• EDR: All Supported Versions

Symptoms

• No threat report for yara feed
• DEBUG-Exception in wait: Error 104 while writing to socket. Connection reset by peer.

Cause

Redis queue is overwhelmed and over the client output buffer limit

Resolution

1. Change client-output-buffer lines in /etc/cb/redis.conf.template. Try using the first configuration settings to double the available memory for the client output buffers. If this does not improve the connectivity, testing with unlimited buffer sizes can be accomplished with the second set of configuration settings:

• Increase client output buffer size to twice the default

client-output-buffer-limit normal 0 0 0 
client-output-buffer-limit slave 512mb 128mb 60 
client-output-buffer-limit pubsub 64mb 32mb 60

• Set client output buffer size to unlimited

client-output-buffer-limit normal 0 0 0
client-output-buffer-limit slave 0 0 0
client-output-buffer-limit pubsub 0 0 0

3. Reboot the operating system
4. Start Yara Manager

Related Content

• EDR: Yara Feed Not Visible on Threat Intelligence Feed Page
• CB Response: No threat reports in the Yara connector in the web console