EDR Yara-Connector: ERROR-Something went wrong sweeping the CbR module store

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Error seen in /var/log/cb/integrations/cb-yara-connector/yaraconnector.log :

2021-09-27 11:38:32,844-yaraconnector-200-WARNING-The remote minion has not finished processing yara ruleset update for 120 seconds. Ensure the remote minion is available and can reach the configured celery broker
2021-09-27 11:38:32,844-yaraconnector-285-ERROR-Something went wrong sweeping the CbR module store:
Traceback (most recent call last):
  File "celery/backends/asynchronous.py", line 266, in _wait_for_pending
  File "celery/backends/asynchronous.py", line 53, in drain_events_until
socket.timeout

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "cbopensource/connectors/yara_connector/database_scanning.py", line 198, in do_remote_rule_update
  File "celery/result.py", line 230, in get
  File "celery/backends/asynchronous.py", line 200, in wait_for_pending
  File "celery/backends/asynchronous.py", line 272, in _wait_for_pending
celery.exceptions.TimeoutError: The operation timed out.

 

Environment

• EDR CB-Yara-Connector Cluster: All Supported Versions

Cause

• The primary CB-Yara-Connector node cannot communicate with the minion, or the minion service is not running.

Resolution

• Verify network connection from the master node to the minion node.
• Confirm the cb-yara-connector is running on the minion node:

systemctl start cb-yara-connector
systemctl status cb-yara-connector