gwapi not running after 11.3.2 upgrade

[SSSSYYYY]

Dear McAfee, We are seeing the below error in message.log and red flag on GUI, saying: McAfee-ERC-1260 /var/log # NitroStarted NotOk not running: gwapi(DNZ O365) This DS was running fine prior to the upgrade from 10.4 to 11.3.2 today. Have tried: stop NitroService, backup existing bookmark file, delete current bookmark file, start NitroService. No change and bookmark file stay empty. I've attached the log to the case. Thanks. Shuai

[lratcliffe · Accepted solution]

Some datasources were moved from gwapi to the ngc collector in 11.3.2.  What is the vendor and model of the datasource you are using?

Have you written datasource settings and rolled out policy from the UI since upgrading?

[SSSSYYYY]

It's Microsoft Office 365. I've write out DS on ERC, but haven't applied manual rule update yet. Will do that and see what happens. Thanks.

[SSSSYYYY]

any idea what this means? Started happening after the upgrade.

L_ERROR 18759|Invalid JSON Config for DS type 586 failed to parse [error = 'Invalid value.', offset = 0]

[lratcliffe]

It means the json file for 586 isn't readable by the collector in use (the files are stored in /etc/NitroGuard/gsql/ )

Looking at my 586 file, it's designed for ngc not gwapi (on 11.3.2) and when I look at my thirdparty.conf my Office365 datasource shows:

collector=ngc

So I suspect your thirdparty.conf file isn't updating correctly.  Please raise a support ticket so we can take a detailed look and assist.

[SSSSYYYY]

Yep, working now. and you are correct, the collector changed from gwapi to ngc