Active Response searches fail when the TTL is set to 1 ms

Technical Articles ID: KB93505
Last Modified: 2023-05-24 09:41:23 Etc/GMT

Environment

Active Response 2.x

Problem

You see the following error when you perform an Active Response search:

An error occurred processing your request. Please try again later.

In Server Settings, Active response server:
You see that Search Time-To-Live, Search Time-To-Live 50%, and Search Time-To-Live at 90% are all set to a value of 1.

In the /opt/McAfee/marserver/apache-tomcat/logs/catalina.out log, you see the following errors:

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'configuration' defined in com.intel.mar.config.ApplicationConfig: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [com.intel.mar.common.Configuration]: Factory method 'configuration' threw exception; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'propertyConfiguration' available

Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [com.intel.mar.common.Configuration]: Factory method 'configuration' threw exception; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'propertyConfiguration' available

Solution

Perform the following steps:

Connect to your Active Response server by SSH logon as root.
Stop the marserver and elasticsearch services:
1. Type service marserver stop and press Enter.
2. Type service elasticsearch stop and press Enter.
Remove /opt/McAfee/marserver/apache-tomcat/webapps/mar:
Type rm -rf /opt/McAfee/marserver/apache-tomcat/webapps/mar and press Enter.
Validate that there's sufficient free disk space on the server:
Type the command df -h and press Enter. If there's sufficient disk space, skip to Step 6.
If there's not enough disk space, run the following commands to free up disk space on the system:
1. Type rm -rf /data/elasticsearch/marta and press Enter.
2. Type rm /var/log/elasticsearch/marta.log and press Enter.
3. Type rm -rf /opt/McAfee/marserver/apache-tomcat-7.0.57/logs/* and press Enter.
4. Type rm catalina.out-* and press Enter.
5. Validate that there's now enough disk space available:
  Type run df -h and press Enter.
  
  NOTE: If you're unsure of what you can delete, contact Technical Support for further assistance.
Start the marserver and elasticsearch services on the Active Response server.
1. Type service elasticsearch start and press Enter.
2. Type service marserver start and press Enter.
If the file is blank and the setting isn't editable on ePolicy Orchestrator (ePO), you can manually input the info on the file with the vi command.
Open /opt/McAfee/marserver/apache-tomcat/webapps/mar/WEB-INF/classes/mar-config.properties in an editor:
Type vi /opt/McAfee/marserver/apache-tomcat/webapps/mar/WEB-INF/classes/mar-config.properties and press Enter.

NOTE: To verify the settings in the mar-config.properties file without having to use the vi editor, run the following command (root permissions required):
grep 'mar.search.default.ttl\|mar.search.ttl.percentage.at50\|mar.search.ttl.percentage.at90' /opt/McAfee/marserver/apache-tomcat/webapps/mar/WEB-INF/classes/mar-config.properties
Make sure that the following entries are as listed below:
mar.search.default.ttl = 60000
mar.search.ttl.percentage.at50 = 80
mar.search.ttl.percentage.at90 = 50
Regenerate the Active Response certificate:
1. Open ePO.
2. Click Server Settings, Active Response Server.
3. Click Edit.
4. Select the Regenerate Active Response Certificates option and then Save.
  The Active Response server is now listed as checked in the Authentication field.
In Server Settings, Active response server, confirm that the Active Response Server settings reflect the values above.

Active Response searches now execute successfully.

NOTE: If your Active Response installation doesn't reflect the listed values, open a Service Request.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Active Response searches fail when the TTL is set to 1 ms

Environment

Problem

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Active Response searches fail when the TTL is set to 1 ms

Environment

Problem

Solution

Affected Products

Languages:

Choose your region

Title

Title