Loading...

Knowledge Center


Threat Intelligence Exchange and Active Response servers are tagged as a DXLBROKER after you disable the DXL Broker service
Technical Articles ID:   KB89300
Last Modified:  11/29/2018

Environment

McAfee Active Response (MAR) 2.x, 1.x
McAfee Data Exchange Layer (DXL) 4.x, 3.x, 2.x
McAfee Threat Intelligence (TIE) Server 2.x

Problem

When you install the McAfee Threat Intelligence or McAfee Active Response server, you can also install the DXL Broker service.

If you later disable the DXL broker service, the TIE or MAR server might still be tagged as DXLBROKER and show in the DXL Topology. This display might give administrators the impression that the DXL broker is still in use.
 

Workaround

To disable the DXL broker service completely:

NOTE: You must log on as root to perform all commands.
  1. Verify that the DXL broker rpm is installed with the following command:

    rpm -qa | grep dxl

    This command outputs an entry similar to the following (the version of DXL broker might be different):

    dxlbroker-3.0.0-285.mlos2.x86_64
     
  2. Remove the rpm dxlbroker-3.0.0-285.mlos2.x86_64 with the following command:

    rpm -e dxlbroker-3.0.0-285.mlos2.x86_64
     
  3. ​Delete the DXLBROKER tag from TIE or MAR server. 
  4. Perform a wake-up call on the server where you removed the DXL broker.

    The DXLBROKER tag no longer appears and the server no longer appears on the DXL Topology or DXL Fabric pages.
To re-enable the DXL broker service, you must log on to your TIE or MAR server and use the change-services script. There is no need to reinstall the RPM because the script installs the DXL broker RPM automatically.

Rate this document

Beta Translate with

Select a desired language below to translate this page.

Glossary of Technical Terms


 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.