Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Missing Syslog feed storage events

Missing Syslog feed storage events

This solution applies to all Carbon Black versions.


Following 'feed.ingress.hit.process' events, the subsequent '' event is not observed. Note that Syslog events can be found in /var/log/messages or from /var/log/cb/notifications/cb-all-notifications.log for Watchlists on the Carbon Black Server. The '' events are important, they indicate the data has been written to disk. An example feed.ingress.hit.process event:

Jan 23 11:18:07 [36618] <warning>  reason=feed.ingress.hit type=event ...

And the expected subsequent event that is not present:

Jan 23 11:44:12 [38873] <warning> type=event ...



The following error message may be observed in /var/log/cb/datastore/debug.log, where mycbserver.local is the server's physical host name:

2015-01-08 00:01:50,524 - [ERROR] - from com.carbonblack.cbfs.ingress_search.IngressScanner in DataStore::Storage_7

Error getting server name or version mycbserver.local: mycbserver.local: Name or service not known


To resolve the issue, ensure the Carbon Black server can resolve it's own host name by updating the /etc/hosts file, such as: mycbserver mycbserver.local localhost

::1 mycbserver mycbserver.local localhost

After making the above change, restart the services:

service cb-enterprise restart

Important Note(s)

The symptom my manifest itself in other ways besides unknown '' events. If a similar "UnknownHostException" message appears in other logs, follow similar steps to ensure the Carbon Black Server can resolve it's own fully qualified domain name.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Creation Date: