Callback detector not updating

[ghunjan]

After NSM upgrade from 8.3.7.64 to 9.1.1.75

Callback Detector is not getting updated automatically.

When tried to Download Callback detector manually, it throws error: "Concurrent Expception Bot Dat is already in progress".

Restarted the McAfee Network Security Manager Service and it updated. 

But now it is again stuck and Callback Detector is Out of date.

No connection issues between Manager and Sensor

Please advise.

Thanks,

Gagandeep 

[daloy · Accepted solution]

The issue as you describe it would be between the NSM and the botnet update URL....

Have you tried restarting NSM and getting a pcap from the NSM itself when the update fails (ideally from when you start it to download)?

Regards,

David

[ghunjan]

Hi David,

Thanks for reaching out. 

Please see the Health check below. 

The only way I see to reboot NSM, is rebooting individual Sensors. If that is the case, would you recommend me to reboot hitless or full reboot?

Is there any other way to reboot NSM?

For pcap, shall I keep this default setting?

Thanks,

Gagandeep

[mjesmer]

.Rebooting the sensors is not what he was suggesting. The NSM Application is hosted on a Server, to "reboot" the NSM you either need to kill the services on that server for the NSM, or reboot that host server completely.

My understanding of the issue you are having is that after upgrading the DAT files are not getting updated on the Manager automatically. And upon manual update you are seeing that the process is hung for DAT Update and throwing a duplicate process exception.

What are the automatic update settings for Callback Detectors on your NSM?

It might be worth changing this to manual, saving it. Restarting the NSM Services on the host server, then updating to the latest DAT and restoring the automatic download and update to its original settings prior to restart, and monitor for issues.

But if this community cannot get it resolved for you, I would suggest contacting support and getting an SR opened if you haven't already.

[ghunjan]

Hi mjeser,

No, it did not resolve the issue. Although after reboot Callback Detector updated to the latest version but again now it is outdated.
Shall I check ems.log or some other log files to see the cause?

[ghunjan]

Hi David,

Sorry for the delay getting back. 

No, I did not had a chance but Callback Detectors is getting updated to the latest available version with out Restarting Host or any service for last week.

As far as I know no change is made on the NSM.

This is the current status of Health check. Marking this as Resolved now.

[petermason]

Hi Ghunjan,

Are you seeing any errors if you run the Health Check -  Callback Detectors Update Server Connectivity ?

Have you checked the logs for errors at the time the process is failing?

Regards

Peter Mason

[ghunjan]

Hi Peter,

Healthcheck looks ok so far. 

I have checked ems.log and I don't see any issue there... 

Thanks,

Gagandeep

[lpinheir]

Have you tried the manual update by downloading the .zip file and importing it manually on the NSM?

Please, check it here: http://download.nai.com/products/botnet/

And here: https://docs.mcafee.com/bundle/network-security-platform-9.1.x-product-guide/page/GUID-6A5B718D-B165...

I suggest you restart the entire NSM server before to that.

Lucas

[ghunjan]

Restarting NSM Server or just the NSM manager service lets the CallBack detector to be updated to the latest version which is available but when the Automatic CallBack Detector checks for the latest update again, it fails download and install.

Could you direct me the logs and error I should investigate into?