<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Nodes keep stopping - how to start and keep them started? in General Topics</title>
    <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217687#M97057</link>
    <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/42784"&gt;@hshawn&lt;/a&gt;,&lt;/P&gt;
&lt;P&gt;are you running MM on CentOS?&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;luigi&lt;/P&gt;</description>
    <pubDate>Wed, 13 Jun 2018 09:03:56 GMT</pubDate>
    <dc:creator>lmori</dc:creator>
    <dc:date>2018-06-13T09:03:56Z</dc:date>
    <item>
      <title>Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/216539#M97052</link>
      <description>&lt;P&gt;Just spun up a new Minemeld server and its working however the nodes like to just stop and I am not sure how to get them to start up and stay started. Rebooting will bring everything back up and they wiull be started for about a minute then they all stop (see screenshot). At home I dont have this issue, all the nodes stay running/started and do their polling, etc without issues. I should be seeing waaaaaaay more indicators specially on the alienvault_reputation node. Thoughts?&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2018-06-04 12_09_24-MineMeld.png" style="width: 800px;"&gt;&lt;img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/15372iE2EC730EE0FA70B7/image-size/large/is-moderation-mode/true?v=v2&amp;amp;px=999" role="button" title="2018-06-04 12_09_24-MineMeld.png" alt="2018-06-04 12_09_24-MineMeld.png" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 04 Jun 2018 19:11:26 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/216539#M97052</guid>
      <dc:creator>hshawn</dc:creator>
      <dc:date>2018-06-04T19:11:26Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/216658#M97053</link>
      <description>&lt;P&gt;I am going to reply to my own post here with more info... I have been trying things to get this working and I have discovered the following:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;* If I remove the alienvault_reputation input from the inboundaggregator then commit the alienvault_reputation miner gathers everything and all the nodes stay up and running (but of course now the EDL will be missing the ~60,000 objects from the alienvault node&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;* If I add the alienvault node back into the aggregator and commit then it tries to poll and stops around 10,000 objects (sometimes less) and then all the nodes grind to a halt again&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;Here you can see all nodes running and the alienvault poll completes&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2018-06-05 07_42_08-MineMeld2.png" style="width: 500px;"&gt;&lt;img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/15378i739F28BEA4A13394/image-size/medium/is-moderation-mode/true?v=v2&amp;amp;px=400" role="button" title="2018-06-05 07_42_08-MineMeld2.png" alt="2018-06-05 07_42_08-MineMeld2.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;But only works when it is *not* added to the inboundaggregator (seen here)&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2018-06-05 07_42_28-MineMeld_configs.png" style="width: 500px;"&gt;&lt;img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/15379i7E2220007A6F2FDC/image-size/medium/is-moderation-mode/true?v=v2&amp;amp;px=400" role="button" title="2018-06-05 07_42_28-MineMeld_configs.png" alt="2018-06-05 07_42_28-MineMeld_configs.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;As soon as I add it to the aggregator and commit all heck breaks loose and it breaks.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;* At home I have a VM running minemeld with the exact same configuration but do not have this issue at all. The only difference between the minemeld instance at home and this one is at home I am using Ubuntu 14.04 and here in the office we are trying to get this going using CentOS 7 so I installed it using the Ansible recipe.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;p.s. Maybe I need to update Minemeld? But there seems to be no minemeld update script when installing using Ansible, how does one update Minemeld on an Ansible CentOS install?&lt;/P&gt;</description>
      <pubDate>Tue, 05 Jun 2018 14:46:50 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/216658#M97053</guid>
      <dc:creator>hshawn</dc:creator>
      <dc:date>2018-06-05T14:46:50Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217024#M97054</link>
      <description>&lt;P&gt;Hi &lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/42784"&gt;@hshawn&lt;/a&gt;,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;this looks like a lack of computing resources to me. Any chance to take a look to /opt/minemeld/log/minemeld-engine.log to see if there is any clue there?&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;How does your home computer compares to the one failing to deliver?&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 07 Jun 2018 15:46:14 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217024#M97054</guid>
      <dc:creator>xhoms</dc:creator>
      <dc:date>2018-06-07T15:46:14Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217030#M97055</link>
      <description>&lt;P&gt;Thanks&amp;nbsp;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/6710"&gt;@xhoms&lt;/a&gt;,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;This VM here is about 2.5 times the CPU/RAM and disk space being used in my home lab setup with 2vCPU and 4GB of RAM. Here is the output from the log requested I ran a tail -f after a reboot and then adding the alienvault reputation list to the aggregator. After about a minute or so all nodes are now stopped and dead&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:21:49 (2157)basepoller._huppable_wait INFO: hup is clear: False&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:37 (2146)mgmtbus._merge_status ERROR: old clock: 86 &amp;gt; 82 - dropped&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:37 (2146)mgmtbus._merge_status ERROR: old clock: 23 &amp;gt; 22 - dropped&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:37 (2146)mgmtbus._merge_status ERROR: old clock: 21 &amp;gt; 19 - dropped&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;Traceback (most recent call last):&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gevent/greenlet.py", line 327, in run&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; result = self._run(*self.args, **self.kwargs)&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 561, in _ioloop&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; conn.drain_events()&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 323, in drain_events&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; return amqp_method(channel, args)&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/channel.py", line 241, in _close&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; reply_code, reply_text, (class_id, method_id), ChannelError,&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;NotFound: Basic.publish: (404) NOT_FOUND - no exchange 'inboundaggregator' in vhost '/'&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;&amp;lt;Greenlet at 0x7ff0b5cf5f50: &amp;lt;bound method AMQP._ioloop of &amp;lt;minemeld.comm.amqp.AMQP object at 0x7ff0b8218650&amp;gt;&amp;gt;(10)&amp;gt; failed with NotFound&lt;/FONT&gt;&lt;/P&gt;
&lt;P&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:49 (2157)amqp._ioloop_failure ERROR: _ioloop_failure: exception in ioloop&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;Traceback (most recent call last):&lt;/FONT&gt;&lt;/P&gt;
&lt;P&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;Traceback (most recent call last):&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 567, in _ioloop_failure&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; g.get()&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gevent/greenlet.py", line 251, in get&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; raise self._exception&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;NotFound: Basic.publish: (404) NOT_FOUND - no exchange 'inboundaggregator' in vhost '/'&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:49 (2157)chassis.stop INFO: chassis stop called&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:49 (2157)base.state INFO: spamhaus_EDROP - transitioning to state 8&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:49 (2157)basepoller.stop INFO: spamhaus_EDROP - # indicators: 130&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:49 (2157)base.state INFO: dshield_blocklist - transitioning to state 8&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:49 (2157)basepoller.stop INFO: dshield_blocklist - # indicators: 20&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)base.state INFO: inboundaggregator - transitioning to state 8&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)ipop.stop INFO: inboundaggregator - # indicators: 16761&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)base.state INFO: inboundfeedhc - transitioning to state 8&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)base.state INFO: spamhaus_DROP - transitioning to state 8&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)basepoller.stop INFO: spamhaus_DROP - # indicators: 855&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)base.state INFO: inboundfeedmc - transitioning to state 8&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)base.state INFO: malwaredomainlist_ip - transitioning to state 8&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)basepoller.stop INFO: malwaredomainlist_ip - # indicators: 1011&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)base.state INFO: inboundfeedlc - transitioning to state 8&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)base.state INFO: alienvault_reputation - transitioning to state 8&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)basepoller.stop INFO: alienvault_reputation - # indicators: 52338&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;2018-06-07T09:22:52 (2157)chassis.stop INFO: Stopping fabric&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;Traceback (most recent call last):&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gevent/hub.py", line 544, in switch&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; switch(value)&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 575, in _ioloop_failure&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; l()&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/core/minemeld/fabric.py", line 100, in _comm_failure&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; self.chassis.fabric_failed()&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/core/minemeld/chassis.py", line 181, in fabric_failed&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; self.stop()&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/core/minemeld/chassis.py", line 217, in stop&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; self.fabric.stop()&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/core/minemeld/fabric.py", line 112, in stop&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; self.comm.stop()&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 675, in stop&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; sc.disconnect()&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 424, in disconnect&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; self.channel.close()&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/channel.py", line 176, in close&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; self._send_method((20, 40), args)&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/abstract_channel.py", line 56, in _send_method&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; self.channel_id, method_sig, args, content,&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/method_framing.py", line 221, in write_method&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; write_frame(1, channel, payload)&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/transport.py", line 182, in write_frame&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; frame_type, channel, size, payload, 0xce,&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gevent/socket.py", line 460, in sendall&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; data_sent += self.send(_get_memory(data, data_sent), flags)&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gevent/socket.py", line 437, in send&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt; return sock.send(data, flags)&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;error: [Errno 104] Connection reset by peer&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT size="1 2 3 4 5 6 7"&gt;&amp;lt;built-in method switch of greenlet.greenlet object at 0x7ff0b5cf5190&amp;gt; failed with error&lt;/FONT&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Let me know what you think, thanks!&lt;/P&gt;</description>
      <pubDate>Thu, 07 Jun 2018 16:36:35 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217030#M97055</guid>
      <dc:creator>hshawn</dc:creator>
      <dc:date>2018-06-07T16:36:35Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217036#M97056</link>
      <description>&lt;P&gt;More data to process...&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;The issue seems to lie with that alienvault feed. If I remove that I can add all the miners and add them to the aggregator that I want. Right now I have had 10 miners running without issues. If anyone can identify the issue with the alienvault feed I will pop it back in there but for now I am just happy to have some hc and mc lists working&lt;/P&gt;</description>
      <pubDate>Thu, 07 Jun 2018 17:33:17 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217036#M97056</guid>
      <dc:creator>hshawn</dc:creator>
      <dc:date>2018-06-07T17:33:17Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217687#M97057</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/42784"&gt;@hshawn&lt;/a&gt;,&lt;/P&gt;
&lt;P&gt;are you running MM on CentOS?&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;luigi&lt;/P&gt;</description>
      <pubDate>Wed, 13 Jun 2018 09:03:56 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217687#M97057</guid>
      <dc:creator>lmori</dc:creator>
      <dc:date>2018-06-13T09:03:56Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217742#M97058</link>
      <description>&lt;P&gt;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/11678"&gt;@lmori&lt;/a&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Yes, CentOS 7&lt;/P&gt;</description>
      <pubDate>Wed, 13 Jun 2018 14:22:11 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/217742#M97058</guid>
      <dc:creator>hshawn</dc:creator>
      <dc:date>2018-06-13T14:22:11Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221196#M97059</link>
      <description>&lt;P&gt;This weekend I spun up a new CentOS VM and did a fresh install of Minemeld using ansible, then I added the alienvault.reputation feed to it and saw the same behavior I am seeing in Minemeld on the corp network. the alienvault feed starts to poll and then all the nodes die and Minemeld becomes dead weight.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;This leads me to believe something with the ansible install or with CentOS does not agree or play nice with something in the alienvault.reputation feed.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;What I can confirm:&lt;/P&gt;
&lt;P&gt;* All works great with the Ubuntu OVA setup no issues at all&lt;/P&gt;
&lt;P&gt;* Breaks when adding alienvault reputation feed on an ansible installed CentOS setup&lt;/P&gt;
&lt;P&gt;* I have reached the end of my troubleshooting abilities on this one, if anyone wants to take a crack at it all the logs and info should be in this thread but I can provide more details if needed&lt;/P&gt;</description>
      <pubDate>Mon, 09 Jul 2018 14:44:42 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221196#M97059</guid>
      <dc:creator>hshawn</dc:creator>
      <dc:date>2018-07-09T14:44:42Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221636#M97060</link>
      <description>&lt;P&gt;Hi Shawn,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I'm going to try to replicate your MM installation on CentOS 7.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Did you use &lt;A href="https://github.com/PaloAltoNetworks/minemeld-ansible" target="_self"&gt;this&lt;/A&gt; ansible playbook?&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;If so, did you keep "&lt;SPAN class="pl-ent"&gt;minemeld_version&lt;/SPAN&gt;&lt;SPAN&gt;: &lt;/SPAN&gt;&lt;SPAN class="pl-s"&gt;develop" or "Stable" ?&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 10 Jul 2018 23:34:33 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221636#M97060</guid>
      <dc:creator>tyreed</dc:creator>
      <dc:date>2018-07-10T23:34:33Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221638#M97061</link>
      <description>&lt;P&gt;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/83114"&gt;@tyreed&lt;/a&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Yes, that is the playbook I used. Fresh install of latest CentOS 7 and used the stable minemeld branch. It should install without issues but you might run into an error with an obsolete package that you need to manually install and then start the ansible install again and it will finish up pretty quickly.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Once everything is up and running try adding the alienvault.reputation feed and see how it goes.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Good luck! Let us know how it goes&lt;/P&gt;</description>
      <pubDate>Tue, 10 Jul 2018 23:56:20 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221638#M97061</guid>
      <dc:creator>hshawn</dc:creator>
      <dc:date>2018-07-10T23:56:20Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221668#M97062</link>
      <description>&lt;P&gt;Tonight&amp;nbsp;I finished building&amp;nbsp;this out in my lab. Centos 7 and the ansible 'stable' minemeld branch. Added the alienvault.reputation feed, and sure enough it killed off&amp;nbsp;most of the four other miners when it hit ~15-18k indicators, which is about 3-5 minutes after the engine started. Restarting the engine will restart all miners, but the failure mode is consistent.&amp;nbsp;The alienvault.reputation miner never advances past that number (or completes polling), despite the feed having around 60k indicators (as seen on a successful polling in my Ubuntu MM). Interesting. The feed works fine in my&amp;nbsp;Ubuntu MM with just 1 GB ram and 1 core (and like 20 other feeds)&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I noted that this miner uses Class:&amp;nbsp;minemeld.ft.csv.CSVFT, and i wonder if it's an issue with that class on Centos. To confirm, i found another&amp;nbsp;miner using this class (bambenekconsulting.c2_ipmasterlist) to see if the behavior is the same,&amp;nbsp;but it completes polling successfully. Only 437 indicators, so next I'll try a feed of the same class with more indicators, closer to the scale of alienvault. This will be a bit of trial/error work.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Another option&amp;nbsp;I found is to try running it in Docker, which contains all the necessary dependencies in the container:&amp;nbsp;&lt;A href="https://hub.docker.com/r/jtschichold/minemeld/" target="_blank"&gt;https://hub.docker.com/r/jtschichold/minemeld/&lt;/A&gt; but i'm out of time tonight. I'll take a look at this later on this week, unless you want to take a first pass&amp;nbsp;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/42784"&gt;@hshawn&lt;/a&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Cheers&lt;/P&gt;</description>
      <pubDate>Wed, 11 Jul 2018 05:36:31 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221668#M97062</guid>
      <dc:creator>tyreed</dc:creator>
      <dc:date>2018-07-11T05:36:31Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221857#M97063</link>
      <description>&lt;P&gt;I did try other miners of the same class, and they worked without incident, but were all small. So perhaps it's scale related. I created a new miner (not a clone) to temporarily mine the alienvault.reputation database from a website&amp;nbsp;I control. This&amp;nbsp;new miner crashed in the same way the included&amp;nbsp;alienvault.reputation one&amp;nbsp;did.&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I noted&amp;nbsp;minemeld-traced.log is non-zero bytes, and upon looking in there it seems the engine crashes due to unhandled exceptions.&lt;/P&gt;
&lt;PRE&gt;2018-07-11T00:43:37 (8424)storage.remove_reference WARNING: Attempt to remove non existing reference: 2e5b0b9c-c47b-44Traceback (most recent call last):
  File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gevent/greenlet.py", line 327, in run
    result = self._run(*self.args, **self.kwargs)
  File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 561, in _ioloop
    conn.drain_events()
  File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 323, in drain_events
    return amqp_method(channel, args)
  File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 529, in _close
    (class_id, method_id), ConnectionError)
ConnectionForced: (0, 0): (320) CONNECTION_FORCED - broker forced connection closure with reason 'shutdown'
&amp;lt;Greenlet at 0x7fb4e5de5230: &amp;lt;bound method AMQP._ioloop of &amp;lt;minemeld.comm.amqp.AMQP object at 0x7fb4e5e021d0&amp;gt;&amp;gt;(0)&amp;gt; fai
&lt;/PRE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Everthing begins to fall apart in the&amp;nbsp;minemeld-engine.log&amp;nbsp;here (before this timestamp things appear healthy):&lt;/P&gt;
&lt;PRE&gt;2018-07-11T00:38:59 (9727)mgmtbus._merge_status ERROR: old clock: 90 &amp;gt; 74 - dropped
2018-07-11T00:38:59 (9727)mgmtbus._merge_status ERROR: old clock: 21 &amp;gt; 20 - dropped
2018-07-11T00:38:59 (9727)mgmtbus._merge_status ERROR: old clock: 20 &amp;gt; 19 - dropped
2018-07-11T00:38:59 (9727)mgmtbus._merge_status ERROR: old clock: 22 &amp;gt; 20 - dropped
Traceback (most recent call last):
  File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gevent/greenlet.py", line 327, in run
    result = self._run(*self.args, **self.kwargs)
  File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 561, in _ioloop
    conn.drain_events()
  File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 323, in drain_events
    return amqp_method(channel, args)
  File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/channel.py", line 241, in _close
    reply_code, reply_text, (class_id, method_id), ChannelError,
NotFound: Basic.publish: (404) NOT_FOUND - no exchange 'inboundaggregator' in vhost '/'
&amp;lt;Greenlet at 0x7f7939978190: &amp;lt;bound method AMQP._ioloop of &amp;lt;minemeld.comm.amqp.AMQP object at 0x7f793b0d1d10&amp;gt;&amp;gt;(11)&amp;gt; fa

2018-07-11T00:39:17 (9741)amqp._ioloop_failure ERROR: _ioloop_failure: exception in ioloop
Traceback (most recent call last):
  File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 567, in _ioloop_failure
    g.get()
  File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gevent/greenlet.py", line 251, in get
    raise self._exception
NotFound: Basic.publish: (404) NOT_FOUND - no exchange 'inboundaggregator' in vhost '/'
2018-07-11T00:39:17 (9741)chassis.stop INFO: chassis stop called
&lt;/PRE&gt;
&lt;P&gt;When comparing this to my Ubuntu MM, I noted that there are errors, but no 'clock' errors in the logs. I started poking around in the python to see how clock is used, but am now out of time again.&amp;nbsp;Documenting all of this here before it slips out of my mind.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 11 Jul 2018 22:57:22 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221857#M97063</guid>
      <dc:creator>tyreed</dc:creator>
      <dc:date>2018-07-11T22:57:22Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221934#M97064</link>
      <description>&lt;P&gt;I gave the docker image a shot yesterday it seems to be still a work in progresss, it did come up but loging into minemeld was not working so I shelved it and went back to poking at the CentOS setup. It sounds like &lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/83114"&gt;@tyreed&lt;/a&gt;&amp;nbsp;you are going down some rabbit holes with this, don't stare at it too long, your vision may blur &lt;span class="lia-unicode-emoji" title=":winking_face:"&gt;😉&lt;/span&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 12 Jul 2018 14:55:52 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/221934#M97064</guid>
      <dc:creator>hshawn</dc:creator>
      <dc:date>2018-07-12T14:55:52Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/222190#M97065</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/83114"&gt;@tyreed&lt;/a&gt;,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I have fixed this issue in the latest version of minemeld-ansible. Could you try reinstalling the instance with the last minemeld-ansible playbook please?&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 13 Jul 2018 12:26:18 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/222190#M97065</guid>
      <dc:creator>lmori</dc:creator>
      <dc:date>2018-07-13T12:26:18Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/222236#M97066</link>
      <description>&lt;P&gt;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/11678"&gt;@lmori&lt;/a&gt;&amp;nbsp;I took the following steps this morning:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;* refresh git repo&lt;/P&gt;
&lt;P&gt;* re-run ansible playbook&lt;/P&gt;
&lt;P&gt;* reboot server&lt;/P&gt;
&lt;P&gt;* add alienvault reputation&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;results: it looked like it was going to be happy but after about a minute all the nodes stopped and the alienvault poll stopped at around 17k (there are usually around 50k in there)&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;After removing alienvault and comitting everything is happy again (but it takes about 8 minutes to restart the engine when this happens). Is there a better way to update the system? Should I completely wipe out the previous install and redo it from zero?&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;TIA!&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Errors in the log around the time of this event (possibly unrelated):&lt;/P&gt;
&lt;PRE&gt;[2018-07-13 07:41:04 PDT] [887] [ERROR] Exception on /status/minemeld [GET]
Traceback (most recent call last):
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/app.py", line 1988, in wsgi_app
response = self.full_dispatch_request()
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/app.py", line 1641, in full_dispatch_request
rv = self.handle_user_exception(e)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/app.py", line 1544, in handle_user_exception
reraise(exc_type, exc_value, tb)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/app.py", line 1639, in full_dispatch_request
rv = self.dispatch_request()
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/app.py", line 1625, in dispatch_request
return self.view_functions[rule.endpoint](**req.view_args)
File "/opt/minemeld/engine/core/minemeld/flask/aaa.py", line 125, in decorated_view
return f(*args, **kwargs)
File "/opt/minemeld/engine/core/minemeld/flask/aaa.py", line 135, in decorated_view
return f(*args, **kwargs)
File "/opt/minemeld/engine/core/minemeld/flask/statusapi.py", line 171, in get_minemeld_status
status = MMMaster.status()
File "/opt/minemeld/engine/core/minemeld/flask/mmrpc.py", line 51, in status
return self._send_cmd('status')
File "/opt/minemeld/engine/core/minemeld/flask/mmrpc.py", line 41, in _send_cmd
self._open_channel()
File "/opt/minemeld/engine/core/minemeld/flask/mmrpc.py", line 38, in _open_channel
self.comm.start()
File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 595, in start
c = amqp.connection.Connection(**self.amqp_config)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 165, in __init__
self.transport = self.Transport(host, connect_timeout, ssl)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/connection.py", line 186, in Transport
return create_transport(host, connect_timeout, ssl)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/transport.py", line 299, in create_transport
return TCPTransport(host, connect_timeout)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/amqp/transport.py", line 95, in __init__
raise socket.error(last_err)
error: [Errno 111] Connection refused
[2018-07-13 07:41:05 +0000] [887] [ERROR] Error handling request
Traceback (most recent call last):
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gunicorn/workers/async.py", line 52, in handle
self.handle_request(listener_name, req, client, addr)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gunicorn/workers/ggevent.py", line 159, in handle_request
super(GeventWorker, self).handle_request(*args)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/gunicorn/workers/async.py", line 105, in handle_request
respiter = self.wsgi(environ, resp.start_response)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/app.py", line 2000, in __call__
return self.wsgi_app(environ, start_response)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/app.py", line 1996, in wsgi_app
ctx.auto_pop(error)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/ctx.py", line 387, in auto_pop
self.pop(exc)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/ctx.py", line 376, in pop
app_ctx.pop(exc)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/ctx.py", line 189, in pop
self.app.do_teardown_appcontext(exc)
File "/opt/minemeld/engine/current/lib/python2.7/site-packages/flask/app.py", line 1898, in do_teardown_appcontext
func(exc)
File "/opt/minemeld/engine/core/minemeld/flask/mmrpc.py", line 207, in teardown
g.MMMaster.stop()
File "/opt/minemeld/engine/core/minemeld/flask/mmrpc.py", line 55, in stop
self.comm.stop()
File "/opt/minemeld/engine/core/minemeld/comm/amqp.py", line 685, in stop
self.rpc_out_channel.close()
AttributeError: 'NoneType' object has no attribute 'close'&lt;/PRE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Update: I tried not adding alienvault to the aggregator until it finished polling. The alienvault node will completely poll and finish if it is not added to the aggregator, however once it is added then that is when the nodes get killed.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 13 Jul 2018 15:10:42 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/222236#M97066</guid>
      <dc:creator>hshawn</dc:creator>
      <dc:date>2018-07-13T15:10:42Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/234444#M97067</link>
      <description>&lt;P&gt;Hi,&lt;BR /&gt;&lt;BR /&gt;A few days ago, I installed Minemeld con Ansible and Ubuntu 18.&lt;BR /&gt;&lt;BR /&gt;I think , I have a similar problem but with&amp;nbsp; urlhaus.URL.&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;Regards&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2018-10-08 16_24_47-MineMeld.png" style="width: 800px;"&gt;&lt;img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17056i6C42E5532DC303A8/image-size/large/is-moderation-mode/true?v=v2&amp;amp;px=999" role="button" title="2018-10-08 16_24_47-MineMeld.png" alt="2018-10-08 16_24_47-MineMeld.png" /&gt;&lt;/span&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2018-10-08 16_25_05-MineMeld.png" style="width: 800px;"&gt;&lt;img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17053i4B923C1D4C031CA2/image-size/large/is-moderation-mode/true?v=v2&amp;amp;px=999" role="button" title="2018-10-08 16_25_05-MineMeld.png" alt="2018-10-08 16_25_05-MineMeld.png" /&gt;&lt;/span&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2018-10-08 16_25_17-MineMeld.png" style="width: 800px;"&gt;&lt;img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17054iEC3941FF5FEB9258/image-size/large/is-moderation-mode/true?v=v2&amp;amp;px=999" role="button" title="2018-10-08 16_25_17-MineMeld.png" alt="2018-10-08 16_25_17-MineMeld.png" /&gt;&lt;/span&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2018-10-08 16_25_27-MineMeld.png" style="width: 800px;"&gt;&lt;img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17055i4FDB23DECB060172/image-size/large/is-moderation-mode/true?v=v2&amp;amp;px=999" role="button" title="2018-10-08 16_25_27-MineMeld.png" alt="2018-10-08 16_25_27-MineMeld.png" /&gt;&lt;/span&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="2018-10-08 16_25_41-MineMeld.png" style="width: 800px;"&gt;&lt;img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/17057i3EE462EF2513D530/image-size/large/is-moderation-mode/true?v=v2&amp;amp;px=999" role="button" title="2018-10-08 16_25_41-MineMeld.png" alt="2018-10-08 16_25_41-MineMeld.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Regards&lt;/P&gt;</description>
      <pubDate>Mon, 08 Oct 2018 14:27:48 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/234444#M97067</guid>
      <dc:creator>Sistemas_SanLucar</dc:creator>
      <dc:date>2018-10-08T14:27:48Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/234572#M97068</link>
      <description>&lt;P&gt;Might be related but what I am seeing is all nodes will stop instead of just some of them.&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;OT but how did you get the ansible install to work on Ubuntu18? Mine will error out right away.&lt;/P&gt;</description>
      <pubDate>Tue, 09 Oct 2018 14:12:24 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/234572#M97068</guid>
      <dc:creator>hshawn</dc:creator>
      <dc:date>2018-10-09T14:12:24Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/235093#M97069</link>
      <description>&lt;P&gt;Hi&amp;nbsp;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/39199"&gt;@Sistemas_SanLucar&lt;/a&gt;,&lt;/P&gt;
&lt;P&gt;that is a conflict with RabbitMQ version installed by default on Ubuntu 18, that is also we don't support Ubuntu 18 yet in the Ansible playbook. You should install an older RabbitMQ release (3.2.X)&lt;/P&gt;</description>
      <pubDate>Fri, 12 Oct 2018 06:48:12 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/235093#M97069</guid>
      <dc:creator>lmori</dc:creator>
      <dc:date>2018-10-12T06:48:12Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/235106#M97070</link>
      <description>&lt;P&gt;&lt;BR /&gt; &lt;BR /&gt; 1)a) Add the repositories fo file /etc/apt/sources.list&lt;BR /&gt; &lt;BR /&gt; &lt;STRONG&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;deb &lt;A href="http://us.archive.ubuntu.com/ubuntu/" target="_blank"&gt;&lt;SPAN style="font-weight: normal;"&gt;http://us.archive.ubuntu.com/ubuntu/&lt;/SPAN&gt;&lt;/A&gt; bionic universe /etc/apt/sources.list&lt;/SPAN&gt;&lt;/STRONG&gt;&lt;BR /&gt; &lt;STRONG&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;deb &lt;A href="http://minemeld-updates.panw.io/ubuntu" target="_blank"&gt;&lt;SPAN style="font-weight: normal;"&gt;http://minemeld-updates.panw.io/ubuntu&lt;/SPAN&gt;&lt;/A&gt; trusty-minemeld main&lt;/SPAN&gt;&lt;/STRONG&gt;&lt;BR /&gt; &lt;BR /&gt; 1)&amp;nbsp;&amp;nbsp;&amp;nbsp; $ sudo apt-get update&lt;BR /&gt; 2)&amp;nbsp;&amp;nbsp;&amp;nbsp; $ sudo apt-get upgrade # optional&lt;BR /&gt; 3)&amp;nbsp;&amp;nbsp;&amp;nbsp; $ sudo apt-get install -y gcc git python-minimal python2.7-dev libffi-dev libssl-dev make&lt;BR /&gt; 4)&amp;nbsp;&amp;nbsp;&amp;nbsp; $ wget &lt;A href="https://bootstrap.pypa.io/get-pip.py" target="_blank"&gt;https://bootstrap.pypa.io/get-pip.py&lt;/A&gt;&lt;BR /&gt; 5)&amp;nbsp;&amp;nbsp;&amp;nbsp; $ sudo -H python get-pip.py&lt;BR /&gt; 6)&amp;nbsp;&amp;nbsp;&amp;nbsp; $ sudo -H pip install ansible&lt;BR /&gt; 7)&amp;nbsp;&amp;nbsp;&amp;nbsp; $ git clone &lt;A href="https://github.com/PaloAltoNetworks/minemeld-ansible.git" target="_blank"&gt;https://github.com/PaloAltoNetworks/minemeld-ansible.git&lt;/A&gt;&lt;BR /&gt; &lt;span class="lia-unicode-emoji" title=":smiling_face_with_sunglasses:"&gt;😎&lt;/span&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; $ cd minemeld-ansible&lt;BR /&gt; &lt;BR /&gt; 8)a) After setp 8), we modified configuration&lt;BR /&gt; &lt;BR /&gt; I copeid the files&amp;nbsp; Ubuntu-16.04.yml to Ubuntu-18.04.yml&amp;nbsp; in directory structure , these files didn't exist in setup.&lt;BR /&gt;Current structure:&lt;BR /&gt; &lt;BR /&gt; &lt;BR /&gt; ./roles/infrastructure/vars/Ubuntu-14.04.yml&lt;BR /&gt; ./roles/infrastructure/vars/Ubuntu-16.04.yml&lt;BR /&gt; &lt;STRONG&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;./roles/infrastructure/vars/Ubuntu-18.04.yml&lt;/SPAN&gt;&lt;/STRONG&gt;&lt;BR /&gt; &lt;BR /&gt; ./roles/minemeld/vars/Ubuntu-14.04.yml&lt;BR /&gt; ./roles/minemeld/vars/Ubuntu-16.04.yml&lt;BR /&gt; &lt;STRONG&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;./roles/minemeld/vars/Ubuntu-18.04.yml&lt;/SPAN&gt;&lt;/STRONG&gt;&lt;BR /&gt; &lt;BR /&gt; &lt;STRONG&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;./roles/minemeld/tasks/Ubuntu-18.04-post.yml&lt;/SPAN&gt;&lt;/STRONG&gt;&lt;BR /&gt; ./roles/minemeld/tasks/Ubuntu-16.04-post.yml&lt;BR /&gt; ./roles/minemeld/tasks/Ubuntu-14.04-post.yml&lt;BR /&gt; &lt;BR /&gt; 8)b) &lt;SPAN class=""&gt;As indicated at the beginning of the README.MD installation manual, we have modified the local.yml file to be able to install the stable version instead of the "dev" development one.&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN class=""&gt;So that the local.yml file remains this way.&lt;/SPAN&gt;&lt;BR /&gt; &lt;BR /&gt; -----------------------------------------&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;- name: minemeld playbook&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; hosts: 127.0.0.1&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; connection: local&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; become: true&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; vars:&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; #&amp;nbsp; minemeld_version: develop&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; file_permissions: 'u=rwX,g=rwX,o=rX'&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; # uncomment the following to install stable&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;/SPAN&gt;&lt;/EM&gt;&lt;STRONG&gt;&lt;I&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt; minemeld_version: master&lt;/SPAN&gt;&lt;/I&gt;&lt;/STRONG&gt;&lt;BR /&gt; &lt;STRONG&gt;&lt;I&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; group_permissions: 'u=rwX,g=rX,o=rX'&lt;/SPAN&gt;&lt;/I&gt;&lt;/STRONG&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; # remove comment to set custom repositories&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; # core_repo: "&lt;A href="https://github.com/jtschichold/minemeld-core.git" target="_blank"&gt;&lt;SPAN style="font-style: normal;"&gt;https://github.com/jtschichold/minemeld-core.git&lt;/SPAN&gt;&lt;/A&gt;"&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; # prototype_repo: "&lt;A href="https://github.com/jtschichold/minemeld-node-prototypes.git" target="_blank"&gt;&lt;SPAN style="font-style: normal;"&gt;https://github.com/jtschichold/minemeld-node-prototypes.git&lt;/SPAN&gt;&lt;/A&gt;"&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; # webui_repo: "&lt;A href="https://github.com/jtschichold/minemeld-webui.git" target="_blank"&gt;&lt;SPAN style="font-style: normal;"&gt;https://github.com/jtschichold/minemeld-webui.git&lt;/SPAN&gt;&lt;/A&gt;"&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; roles:&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; - infrastructure&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; &lt;EM&gt;&lt;SPAN style="font-family: 'Calibri',sans-serif;"&gt;&amp;nbsp; - minemeld&lt;/SPAN&gt;&lt;/EM&gt;&lt;BR /&gt; -------------------------------------------&lt;BR /&gt; &lt;BR /&gt; 9)&amp;nbsp;&amp;nbsp;&amp;nbsp; $ ansible-playbook -K -i 127.0.0.1, local.yml&lt;BR /&gt; 10)&amp;nbsp;&amp;nbsp;&amp;nbsp; $ usermod -a -G minemeld # add your user to minemeld group, useful for development&lt;/P&gt;</description>
      <pubDate>Fri, 12 Oct 2018 11:57:31 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/235106#M97070</guid>
      <dc:creator>Sistemas_SanLucar</dc:creator>
      <dc:date>2018-10-12T11:57:31Z</dc:date>
    </item>
    <item>
      <title>Re: Nodes keep stopping - how to start and keep them started?</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/235107#M97071</link>
      <description>&lt;P&gt;&lt;SPAN class="short_text"&gt;&lt;SPAN class=""&gt;How do i do it?&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;SPAN class="short_text"&gt;thank you&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 12 Oct 2018 11:58:23 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/nodes-keep-stopping-how-to-start-and-keep-them-started/m-p/235107#M97071</guid>
      <dc:creator>Sistemas_SanLucar</dc:creator>
      <dc:date>2018-10-12T11:58:23Z</dc:date>
    </item>
  </channel>
</rss>

