Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Response 6.1 upgrade: fails on CONVERT OLD INGRESS FILTERS

Response 6.1 upgrade: fails on CONVERT OLD INGRESS FILTERS

Version

Cb Response 6.x and later versions

Issue

On startup after upgrade to 6.x in a cluster, it detects schema needs to be updated and runs 'cbupgrade' command but it fails on ingress filter conversion

Symptoms

Console output on startup (of if simply running /usr/share/cb/cbupgrade on master before start)

--------------------------------------------------------------------------------

CONVERT OLD INGRESS FILTERS

--------------------------------------------------------------------------------

Error importing legacy filters from file /etc/cb/ingressfilter.conf

Traceback (most recent call last):

File "/usr/lib/python2.6/site-packages/cb/maintenance/cbupgrade/versions/v6_1_0.py", line 42, in upgrade_ingress_filters

File "/usr/lib64/python2.6/json/__init__.py", line 267, in load

parse_constant=parse_constant, **kw)

File "/usr/lib64/python2.6/json/__init__.py", line 307, in loads

return _default_decoder.decode(s)

File "/usr/lib64/python2.6/json/decoder.py", line 319, in decode

obj, end = self.raw_decode(s, idx=_w(s, 0).end())

File "/usr/lib64/python2.6/json/decoder.py", line 336, in raw_decode

obj, end = self._scanner.iterscan(s, **kw).next()

File "/usr/lib64/python2.6/json/scanner.py", line 55, in iterscan

rval, next_pos = action(m, context)

File "/usr/lib64/python2.6/json/decoder.py", line 171, in JSONObject

raise ValueError(errmsg("Expecting property name", s, end))

ValueError: Expecting property name: line 2 column 1 (char 2)

Cause

This behavior will occur if due to an issue in the file noted above: "Error importing legacy filters from file /etc/cb/ingressfilter.conf".  When previous versions were generally accepting of ingress filter file problems, 6.X will fail on parsing if there are issues in this file

Solution

Review the ingress filter file (/etc/cb/ingressfilter.conf in the example above) for format issues (extra commas, missing lines, etc).  If no issue can be found, you may upload the file to CarbonBlack alliance and request assistance via a new support ticket and mention this KB article and the exact error message encountered.

Using the example above:

/usr/share/cb/cbpost /etc/cb/ingressfilter.conf
Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎05-24-2017
Views:
709
Contributors