EDR: Yara Connector service fails to start with 'specified path parameter 'module_store_location' (/var/cb/data/modulestore) does not exist' error

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Yara Connector service fails to start after following installation steps from the GitHub site (https://github.com/carbonblack/cb-yara-connector) and the journalctl logs show the following error:

yaraconnector[28788]: 2022-08-19 09:09:14,735-yaraconnector-90-ERROR-Unable to continue due to a configuration problem: Config file '/etc/cb/integrations/cb-yara-connector/yaraconnector.conf' specified path parameter 'module_store_location' (/var/cb/data/modulestore) does not exist

Environment

• EDR Server: All Supported Versions
• Yara Connector: 2.x and Higher

Cause

Modulestore folder is not in the default location and the correct path needs to be added to the configuration file.

Resolution

1.  Edit the /etc/cb/integrations/cb-yara-connector/yaraconnector.conf
2. Following the same format as the other entries, add the following lines to specify the custom modulestore path:

   ;
   ; Changing the default modulestore location to the actual location on this server (/app)
   ; Default: /var/cb/data/modulestore
   ;
   module_store_location=/<examplepath>/modulestore

3. Attempt to restart the Yara Connector service:

   systemctl start cb-yara-connector