McAfee Active Response searches fail when the TTL is set to 1 ms

Technical Articles ID: KB93505
Last Modified: 8/27/2021

Environment

McAfee Active Response (MAR) 2.X

Problem

You see the following error when you perform an Active Response search:

An error occurred processing your request. Please try again later.

In Server Settings, Active response server:
You see that Search Time-To-Live, Search Time-To-Live 50%, and Search Time-To-Live at 90% are all set to a value of 1.

In the /opt/McAfee/marserver/apache-tomcat/logs/catalina.out log, you see the following errors:

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'configuration' defined in com.intel.mar.config.ApplicationConfig: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [com.intel.mar.common.Configuration]: Factory method 'configuration' threw exception; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'propertyConfiguration' available

Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [com.intel.mar.common.Configuration]: Factory method 'configuration' threw exception; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionException: No bean named 'propertyConfiguration' available

Solution

Perform the following steps:

Connect to your MAR server by SSH logon as root.
Stop the marserver and elasticsearch services:
1. Type service marserver stop and press Enter.
2. Type service elasticsearch stop and press Enter.
Remove /opt/McAfee/marserver/apache-tomcat/webapps/mar:
Type rm -rf /opt/McAfee/marserver/apache-tomcat/webapps/mar and press Enter.
Validate that there is sufficient free disk space on the server:
Type the command df -h and press Enter. If there is sufficient disk space, skip to step 6.
If there is not enough disk space, run the following commands to free up disk space on the system:
1. Type rm -rf /data/elasticsearch/marta and press Enter.
2. Type rm /var/log/elasticsearch/marta.log and press Enter.
3. Type rm -rf /opt/McAfee/marserver/apache-tomcat-7.0.57/logs/* and press Enter.
4. Type rm catalina.out-* and press Enter.
5. Validate that there is now enough disk space available:
  Type run df -h and press Enter.
  
  NOTE: If you’re unsure of what you can delete, contact Technical Support for further assistance.
Start the marserver and elasticsearch services on the MAR server.
1. Type service elasticsearch start and press Enter.
2. Type service marserver start and press Enter.
If file is blank and setting is not editable on ePO, you can manually input the info on the file with the vi command.
Open /opt/McAfee/marserver/apache-tomcat/webapps/mar/WEB-INF/classes/mar-config.properties in an editor:
Type vi /opt/McAfee/marserver/apache-tomcat/webapps/mar/WEB-INF/classes/mar-config.properties and press Enter.

NOTE: To verify the settings in the mar-config.properties file without having to use the vi editor, run the following command (root permissions required):
grep 'mar.search.default.ttl\|mar.search.ttl.percentage.at50\|mar.search.ttl.percentage.at90' /opt/McAfee/marserver/apache-tomcat/webapps/mar/WEB-INF/classes/mar-config.properties
Make sure that the following entries are as listed below:
mar.search.default.ttl = 60000
mar.search.ttl.percentage.at50 = 80
mar.search.ttl.percentage.at90 = 50
Regenerate the MAR certificate:
1. Open ePO.
2. Click Server Settings, Active Response Server.
3. Click Edit.
4. Select the Regenerate Active Response Certificates checkbox and then Save.
  The MAR server is now listed as checked in the Authentication field.
In Server Settings, Active response server, confirm that the Active Response Server settings reflect the above values.

MAR searches now execute successfully.

NOTE: If your MAR installation doesn't reflect the listed values, open a Service Request.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

Affected Products

Known Issue/Product Defect
McAfee Active Response 2.x

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

McAfee Active Response searches fail when the TTL is set to 1 ms

Environment

Problem

Solution

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

McAfee Active Response searches fail when the TTL is set to 1 ms

Environment

Problem

Solution

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title