topic Re: Error decompressing data stream in General Topics

Error decompressing data stream

BenjaminSand — Tue, 01 Dec 2020 23:25:59 GMT

Greetings All

Been running minemeld for quite a while but have not seen this one before. We are setting up a new threat stream from a government provider that we have been using for a while but they are upgrading to a v4 of their feed. Did everything the same as usual but getting a error "Error -5 while decompressing data: incomplete or truncated stream".

Anyone seen this one?

Thanks

Re: Error decompressing data stream

stapley — Thu, 03 Dec 2020 00:07:36 GMT

We're seeing this same error trying to migrate to v4 of a government-provided feed as well. We were running v3 on a Linux host with Python but want to switch to using MineMeld so all feeds are in one place. Was MineMeld working with v3 previously? Interested in hearing others results.

Re: Error decompressing data stream

BenjaminSand — Thu, 03 Dec 2020 15:28:19 GMT

I've had v3 working for quite a while but v4 seems to be difficult. Tried a few things revolving around changing zlib variables but no luck.

Re: Error decompressing data stream

BenjaminSand — Fri, 04 Dec 2020 23:52:00 GMT

***UPDATE**

If anyone else is having this issue, I found a solution.

First, make sure you are using the updated cif plugin

renisac/CIFv3-Minemeld: Minemeld Miner for CIFv3 / SESv4 (github.com)

next you will need to build a new node using the CIFv3 prototype you just installed.

When I committed the changes, I wasn't able to set the remote or api info from within the web console. I had to do it via the command console by way of copying the side_config.yml file and updating the remote address, changing otype to itype and updating the token info.

The yml file was located in /opt/minemeld/local/config for me but your mileage may vary.

Hope that helps

Re: Error decompressing data stream

stapley — Mon, 07 Dec 2020 16:05:02 GMT

Thanks for the direction BenjaminSand. I can confirm this worked for me as well.