Health Check FailureId[875]: Agent Does Not Have an Active Yara Rules File

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Agents are generating Events for Health Checks FailureId[875] similar to:

Agent does not have an active yara rules file Version[0]. Options[00000003] TotalFailures[1] FailureId[875]

Environment

• App Control Server: All Supported Versions
• App Control Agent: All Supported Versions

Cause

• The Agent has a corrupted or missing Yara file.
• The Server's last automatic generation of the Yara package was either interrupted, or did not build correctly. Expected Yara and actual Yara no longer match.

Resolution

• If the issue is happening on a limited number of devices attempt to manually import the Yara file.
• If the issue is happening on multiple devices, or manually importing yields the error, "Missing schema version" rebuild the Yara file.

If the issue persists, follow the steps to troubleshoot Yara Rules out of Date.