EDR: CB-Yara-Manager Will Not Start: Error:'DuplicateOptionError'

Products

• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

• When attempting to browse to the Yara Manager page the error "There was an error interacting with the Yara Manager, see logs for details. Ensure the Yara Manager installed, configured and running." is encountered.
• This error may be seen in the /var/log/cb/integrations/cb-yara-manager/cb-yara-manager.log:

File "src/app/__init__.py", line 77, in get_cb_response_secret
File "configparser.py", line 763, in readfp
File "configparser.py", line 718, in read_file
File "configparser.py", line 1093, in _read
configparser.DuplicateOptionError: While reading from '<???>' [line 194]: option 'yaramanagerenabled' in section 'root' already exists

Environment

• EDR Server: All Supported Versions

Cause

• The cb-yara-manager service is not running.
• Possible configuration issue.

Resolution

• Ensure the service is running:

systemctl status cb-yara-manager
systemctl restart cb-yara-manager

• If the error above is seen, confirm the following items are accurate and that no duplicates of the entries exist in the /etc/cb/cb.conf file:
  • Confirm no duplicates exist of the following parameters in the /etc/cb/cb.conf file:

YaraManagerEnabled=true
YaraManagerToken=<token_chosen_for_auth>

• Ensure that the 'YaraManagerToken' from above matches the /etc/cb/integrations/cb-yara-manager/auth.conf files "api_token":

api_token=<token_chosen_for_auth>

• Restart the cb-yara-manager service:

systemctl reset-failed
systemctl restart cb-yara-manager