topic expedition cannot read a mounted location in Expedition Discussions

expedition cannot read a mounted location

bartpmika — Tue, 18 Jun 2019 18:14:41 GMT

I am trying to import logs exported from the firewalls to a mounted secondary drive. Expedition says it cannot access that location. I tried multiple permission combinations. Permissions are the same as in the locations that it can access ok. The file system is the same too. It can access this directory, untill I mount the external drive to it. Than it fails again.

To set up the secondary drive I followed the steps from the link below. One difference is that it didn't create sdb1, and mounts sdb itself, other than that everythign is like in that PDF, and the mounted drive works, the logs get exported to it.

Does anyone have any ideas how to get it to work?

https://live.paloaltonetworks.com/t5/Expedition-Discussions/How-to-expand-storage-by-adding-a-second-drive-to-Expedition/td-p/252327?attachment-id=7817

Re: expedition cannot read a mounted location

bartpmika — Tue, 18 Jun 2019 18:52:49 GMT

Actually, it looks like my problem goes even deeper. I moved the log files to sda. I no longer get an error, but it still doesn't display the logs.

Re: expedition cannot read a mounted location

sjanita — Wed, 19 Jun 2019 00:46:32 GMT

the permissions and owners must also be applied at the directory level. Your screenshots show the permissions and owner at the file level.

$sudo ls -ld ./home/logs

The /home/logs directory must provide privileges for www-data and +x permissions

Re: expedition cannot read a mounted location

bartpmika — Wed, 19 Jun 2019 03:04:55 GMT

thanks sjanita,

turns out the folder ownership has to be set to expedition. After I used the command below it stopped giving me this error

sudo chown -R www-data:www-data /hdd

That said, I have more problems now. It doesn't give me the error, but it also doesn't show me the csv files located there. I also tried to change a location of the parquet file store (settings>m.learning). It won't save any changes I make to this location. Somethign had to break after one of the updates.

I will just blast the VM and start over.

Re: expedition cannot read a mounted location

bartpmika — Mon, 24 Jun 2019 18:14:18 GMT

to clarify, the command to set expedition as the owner is:

sudo chown -R expedition.www-data logs

😉