How to integrate KATA and KWTS [KATA/KEDRE]
Entry posted by svc_kms in How-to
6 views
You may have purchased both the KATA and KWTS(Kaspersky Web Traffic Security) products. Since KWTS has built-in KATA integration, you may want to integrate KATA and KWTS.
Problems after integration
Shortly after integration you may notice that on KWTS side, there is an error about sending objects to KATA, and dashboards look similar to this:
Resolution
KATA side
To clean tasks, stuck in 'processing' state, do the following:
1) Find out KWTS ID:
sudo -u kluser psql antiapt -c "select id, sensor_type, sensor_name, ip from lms.client;"
|
On KATA4:
docker exec -it `docker ps | grep kedr_database| awk '{print $1}'` psql -U kluser antiapt -c "select id, sensor_type, sensor_name, ip from lms.client;"
|
Name and IP of KWTS will be the same as in Administrator Web UI, External Systems section.
Then, clean up tasks that may be stuck in 'processing state':
sudo -u kluser psql antiapt -c "update lms.task set state = 'error', has_error = True where client_id = <KWTS ID> and state = 'processing' and update_time < now() - interval '1 hour';"
|
On KATA4:
docker exec -it `docker ps | grep kedr_database| awk '{print $1}'` psql -U kluser antiapt -c "update lms.task set state = 'error', has_error = True where client_id = <KWTS ID> and state = 'processing' and update_time < now() - interval '1 hour';"
|
This command is safe to execute, it will do no harm even if there are no stuck tasks.
To view all active tasks from KSMG/KLMS/KWTS/Other external systems without modifying their states, run the command:
docker exec -it `docker ps | grep kedr_database| awk '{print $1}'` psql -U kluser antiapt -c "select count(*) from lms.task where client_id=<KSMG ID>;"
|
The two commands above can be used to remove tasks stuck in processing from other types of external systems as well.
KWTS side
On KWTS side, it is important to exclude certain type of objects from being scanned in KATA:
In file /var/opt/kaspersky/kwts/kata-filters.json remove the lines, containing keywords:
ArchiveGzip
ArchiveCab
ExecutableJs
|
After applying changes, restart kwts service:
systemctl restarts kwts
|
After these changes, KWTS and KATA integration is expected to work normally further on.
0 Comments
Recommended Comments
There are no comments to display.
Please sign in to comment
You will be able to leave a comment after signing in
Sign In Now