When Saving File Rule, Error Encountered: Something went wrong! See the error log
Article ID: 412583
Updated On:
Products
Carbon Black App Control
Issue/Introduction
- Creating a new Ban or Approval for a File Rule with a File Name (not a hash) results in an error message similar to:
Something went wrong! See the error log.
- High Debug PHPErrors log, during recreation, shows an HTTP 408 (timeout) on the fileCatalogId query, example:
API Error from page 401: GET ServerAddress/api/bit9platform/v1/fileInstance/ with params {"q":"fileName:somefile-*.exe",... with options .... returned http code 408 and result in 180.06469607353 seconds
Environment
- App Control Console: All Supported Versions
Cause
- Before creating a new File Rule, the Server must complete a lookup against the File Catalog (and existing File Rules).
- As soon as a File Name is entered in the field on the File Rule page, a call is initiated against the File Catalog.
- This initial response from SQL Server is taking longer than expected to complete, and when it times out the File Rule is unable to be saved.
Resolution
An investigation into this issue is being tracked by Engineering (EPCB-24140) to determine whether changes can be made to prevent this timeout. In the meantime consider use of the following potential workarounds:
- In general, use of Hash Bans and Approvals should be limited as an over-reliance on these can cause performance issues for the Agent or the Server.
- Avoid the use of wildcards wherever possible, especially if used in a File Name for File Rules.
- Utilize the browser's Developer Tools window and wait for the Ajax post to complete (or fail) after the name is entered. Once the Ajax post is finished, click Save in the UI.
- Paste the file name into the field to limit repeated calls against the File Catalog.
- Create a File Rule using Report first, then afterwards change the File Rule to a Ban or Approval.
Additional Information
Feedback
Yes
No
Powered by
