cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Could not update policy mv

Jump to solution

Has anyone seen this error before? Adding a standard Unix - Linux data source, write out and get this error on ERC: 

- tried manual rule update on ESM, write out to the new data source

- ensured no custom parsers enabled on this data source

Apr 27 04:51:02 McAfee SetFilterConfig[10354]: Called SetFilterConfig with directory: /tmp/5E2736EABFB64452ACD2D453507F0AB

Apr 27 04:51:15 McAfee GSPSetRules: INFO - GSPSetRules(10396) called for 12 Apr 27 04:51:15 McAfee GSPSetRules: ERROR - mv /etc/NitroGuard/asp/policy/cf3e9b9ab85daf773454f3d1de28981b83d6fe8ac1ba4160c55df8e3480ac50eb42f4c1317da9dc4a1864a10fa1d08116ca1549a8357e059ef7843f1b427c16d exited with value 1 Apr 27 04:51:15 McAfee NGExec[10394]: Error: command (/usr/local/bin/GSPSetRules -z -p 12 -i /tmp/F86B7C5036FE4625A9C06E5A7C1E10F) failed; exit: 1, signal: 0 Apr 27 04:51:16 McAfee GSPSetRules: INFO - GSPSetRules(10439) called for 12 Apr 27 04:51:17 McAfee GSPSetRules: ERROR - mv /etc/NitroGuard/asp/policy/cf3e9b9ab85daf773454f3d1de28981b83d6fe8ac1ba4160c55df8e3480ac50eb42f4c1317da9dc4a1864a10fa1d08116ca1549a8357e059ef7843f1b427c16d exited with value 1 Apr 27 04:51:17 McAfee NGExec[10438]: Error: command (/usr/local/bin/GSPSetRules -z -p 12 -i /tmp/959DBE3731E04852912E9AEDAEE485C) failed; exit: 1, signal: 0

1 Solution

Accepted Solutions
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 8

Re: Could not update policy mv

Jump to solution
I've seen this issue in a couple of different ways. In one case the path had managed to disappear (i.e. directory /etc/NitroGuard/asp/policy/ was not present on the system) - for that case, mkdir /etc/NitroGuard/asp/policy resolved it.

On another, this was actually an issue with an individual rule. In order to identify it we needed to capture the temporary files and run GSPSetRule on them manually.

If you need assistance with this please raise a Service Request and one of our support engineers will help.
Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

7 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: Could not update policy mv

Jump to solution

Hi,

Did you try with NGCP and also is there any custom ASP rule enabled for this DS ?

Check if any filters is enabled on this DS ?

Validate if any ASP rules are not enabled on Default Policy level.

 

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
Highlighted

Re: Could not update policy mv

Jump to solution

Yes, confirmed and tried all these. Still having the same error...

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: Could not update policy mv

Jump to solution

Which SIEM version and on which patch you are on ? 

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
Highlighted

Re: Could not update policy mv

Jump to solution

10.4.0 patch 9. 

I see the latest patch is 11, having read the 11 RH, can't see any specific bug fix related to this problem that I am having.

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 8

Re: Could not update policy mv

Jump to solution
I've seen this issue in a couple of different ways. In one case the path had managed to disappear (i.e. directory /etc/NitroGuard/asp/policy/ was not present on the system) - for that case, mkdir /etc/NitroGuard/asp/policy resolved it.

On another, this was actually an issue with an individual rule. In order to identify it we needed to capture the temporary files and run GSPSetRule on them manually.

If you need assistance with this please raise a Service Request and one of our support engineers will help.
Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

Highlighted

Re: Could not update policy mv

Jump to solution

thanks. i've logged a ticket already, support seems to be out of idea atm.

Highlighted

Re: Could not update policy mv

Jump to solution

we had to manually mkdir some folder and roll out policy worked. thanks.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community