Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Missing Syslog feed storage events

Missing Syslog feed storage events

Version
This solution applies to all Carbon Black versions.


Issue

Following 'feed.ingress.hit.process' events, the subsequent 'feed.storage.hit.process' event is not observed. Note that Syslog events can be found in /var/log/messages or from /var/log/cb/notifications/cb-all-notifications.log for Watchlists on the Carbon Black Server. The 'feed.storage.hit' events are important, they indicate the data has been written to disk. An example feed.ingress.hit.process event:

Jan 23 11:18:07 [36618] <warning>  reason=feed.ingress.hit type=event ...

And the expected subsequent feed.storage.hit.process event that is not present:

Jan 23 11:44:12 [38873] <warning>  reason=feed.storage.hit type=event ...

 

Symptoms

The following error message may be observed in /var/log/cb/datastore/debug.log, where mycbserver.local is the server's physical host name:

2015-01-08 00:01:50,524 - [ERROR] - from com.carbonblack.cbfs.ingress_search.IngressScanner in DataStore::Storage_7

Error getting server name or version

java.net.UnknownHostException: mycbserver.local: mycbserver.local: Name or service not known


Solution

To resolve the issue, ensure the Carbon Black server can resolve it's own host name by updating the /etc/hosts file, such as:

127.0.0.1 mycbserver mycbserver.local localhost

::1 mycbserver mycbserver.local localhost

After making the above change, restart the services:

service cb-enterprise restart


Important Note(s)

The symptom my manifest itself in other ways besides unknown 'feed.storage.hit' events. If a similar "UnknownHostException" message appears in other logs, follow similar steps to ensure the Carbon Black Server can resolve it's own fully qualified domain name.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎05-11-2015
Views:
429
Contributors