Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Unpaged request has "x" results, exceeds limit of 1000. Please consider using paging.

EDR: Unpaged request has "x" results, exceeds limit of 1000. Please consider using paging.

Environment

  • EDR: 7.6.0 +

Symptoms

  • When attempting to use the API to query greater than 1000 sensors an error is encountered.  These errors can be encountered via the UI, RestAPI and Python API.
  • Some users have reported seeing this message while using the Python API:
'{"message":"Unpaged request has <num> results, exceeds limit of 1000. Please consider using paging."}'

 

Cause

  • CB-36843 which was remedied in EDR 7.6.0 included a defect fix that implemented a new parameter into the /etc/cb/cb.conf file:
  • By default this is set to '1000'.  Previously it was non-existent.

Resolution

  • For CBAPI:
    • Please upgrade to cbapi 1.7.6 to take advantage of the pagination. No adjustments needed to your script as cbapi will do the pagination. All Products: How to Update CbAPI
  • For Console export:
    • Add the following settings to a value higher than is returned by the unpaged request
      SensorUnpagedFetchLimit=
    • Restart coreservices (primary only for clustered)
      /usr/share/cb/cbservice cb-coreservices restart

Related Content


Labels (2)
Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎12-14-2021
Views:
1474
Contributors