Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Hostpkg page is blank or there are block event for <number>.msi file from Hostpkg folder

Hostpkg page is blank or there are block event for <number>.msi file from Hostpkg folder

Version

6.0.2.x and 7.x

 

Issue / Symptoms

https://<Bit9 server>/hostpkg is blank or there are events showing files like <number>.msi (example: 7.msi) from the hostpkg folder are being blocked or policy msi files in the hostpkg are not updating

 

Cause

The files in the hostpkg folder were not able to update properly. For the block events, it means there’s a Bit9 agent on the Bit9 server that’s analyzing the new msi files each time the package is updated.

 

Solution

Those <number>.msi, <number>.msi_tmp and *.tmp files are temporary files that get created whenever the actual policy msi file is updated. The policy msi file is updated periodically to keep it up to date with all the rules and approval changes made on the console, so a new installation will have the most up to date information once deployed. If the hostpkg link is empty when accessing  it on the Internet browser or if you’re receiving block events for the hostpkg path or your policy msi are not updating, please perform the following steps to resolve it:

 

  1. Stop the Parity Server service
  2. Browse to %program files%\Bit9\Parity Server\hostpkg
  3. Delete the <number>.msi, <number>.msi_tmp, *.tmp
    1. For example: 7.msi, 7.msi_tmp, mypolicy.msi.tmp
    2. Do not delete the other files that do not match the file name pattern mentioned above
  4. Restart the Parity Server service

 

If you have Bit9 agent also installed on the Bit9 server, please add a Performance Optimization rule to have the Bit9 agent ignore the write on the hostpkg folder when done by the Parity Server service. Execution of the fill will still get analyzed and tracked.

Rule Type: Performance Optimization

Path: C:\Program Files\Bit9\Parity Server\Hostpkg (edit the path if you installed Bit9 server on a different location)

Process: Specific Process… C:\Program Files\Bit9\Parity Server\ParityServer.exe (edit the path if you installed Bit9 server on a different location)

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎08-06-2015
Views:
635
Contributors