Unable to start the Threat Intelligence Exchange Server services on an older DXL Broker Combo Server

Technical Articles ID: KB90287
Last Modified: 2023-05-17 05:23:10 Etc/GMT

Environment

Data Exchange Layer Broker (DXL Broker) 4.x
Threat Intelligence Exchange (TIE) Server - all supported versions

Combination TIE Server and DXL Broker Servers only

For details of TIE Server-supported environments, see KB83368 - Supported platforms for Threat Intelligence Exchange Server.

Summary

This article explains an error that might occur where the TIE Server services can't be re-enabled.

Problem

If you use "combo" images to build out your TIE and DXL infrastructure, you might have to opt to use these images as Broker Only systems. In other words, you have to use Broker Only systems rather than a Broker Only OVA.

Over time, it's possible to upgrade the Platform and Broker packages on one of these devices to a point where you can no longer re-enable the existing TIE Server services on the system.

When you run a change-services script to enable the TIE Server services, you encounter an error similar to the following:

Preinstall
/var/tmp/rpm-tmp.RzuTJ7: line 18: /etc/McAfee/tieserver/tie_master_info.conf: No such file or directory
error: %pre(tieserver-1.3.0-235.mlos2.x86_64) scriptlet failed, exit status 1
error: install: %pre scriptlet failed (2), skipping tieserver-1.3.0-235.mlos2
Preparing packages for installation...

Preinstall
/var/tmp/rpm-tmp.HrpxRU: line 18: /etc/McAfee/tieserver/tie_master_info.conf: No such file or directory
error: %pre(tieserver-1.3.0-235.mlos2.x86_64) scriptlet failed, exit status 1
error: install: %pre scriptlet failed (2), skipping tieserver-1.3.0-235.mlos2

TIE Server installation failed. Please request for support. Aborting installation.

Cause

This issue occurs when the RPM libraries that are used to install the TIE Server service aren't upgraded. Specifically, they aren't upgraded during the period that the system is being used as a DXL Broker only.

Solution

Replace the TIE Server RPM file with a newer version:

Verify the currently installed TIE Platform version. Use the following command:

rpm -qa | grep 'tieplatform'
Find the proper TIE Server RPM file that matches the TIE Platform version.

NOTE: The RPM resides inside the TIE Server package, located in the ePolicy Orchestrator Software Manager.
Download the TIE Server package locally to your desktop.
Extract this package and locate the TIE Server RPM. (Example file name: tieserver-2.1.1-226.mlos2.x86_64.rpm)
Use a tool, such as WinSCP, to move the TIE Server RPM file to the /apps folder on the appliance.
Use a text editor, such as vi, to change the property TIESERVER_RPM inside the /apps/apps.list file. Change it with the name of the file previously copied.
Issue the change-service command, and select options accordingly.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Unable to start the Threat Intelligence Exchange Server services on an older DXL Broker Combo Server

Environment

Summary

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Unable to start the Threat Intelligence Exchange Server services on an older DXL Broker Combo Server

Environment

Summary

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title