File carving to Reversing Labs failure - BUFF Load Failure

Products

• Security Analytics

Issue/Introduction

The Reversing Labs feed was not receiving traffic.  There were BUFF or BCWF errors.

Environment

8.2.5

Cause

This may have been caused by BCWF being corrupt. 

Resolution

Clear out the old BCWF files.  The steps are:

1. Login as root to the server
2. Rename the old bcwf files with
   1. mkdir /home/bcwf
   2. mv /var/lib/bcwf/* /home/bcwf
3. Restart the shine loader with systemctl restart shine
4. Restart tonicd with systemctl restart tonicd

The system will rebuild the bcwf tables over time and begin sending files to Reversing Labs again.