Troubleshoot error messages

Prev Next

Available in VPC

You might run into the following problems when using WebShell Behavior Detector. Find out causes and possible solutions.

"[5002] The specified path could not be found" error message

"[5002] The specified path could not be found" error message is displayed.

Cause

The web root/upload path has not been registered.
The web root/upload path is incorrectly entered or an inaccessible path has been specified.

Solution

Check the web root and upload path, and set them correctly.

"[5005] Unable to find the web server environment/path settings for the Pod" error message

"[5005] Unable to find the web server environment/path settings for the Pod" error message is displayed.

Cause

The web root/upload path has not been registered.
The web root/upload path is incorrectly entered or an inaccessible path has been specified.

Solution

Check the web root and upload path, and set them correctly.

"[5101] file quarantine or recovery failed. No files to quarantine or recovery" error message

"[5101] file quarantine or recovery failed. No files to quarantine or recovery" error message is displayed.

Cause

There is no file to perform the task.
Another administrator has accessed the server and performed file quarantine or recovery.

Solution

Access the server and check the files for quarantine or recovery.

"[5102] file quarantine or recovery failed. Files to quarantine or recovery already exist" error message

"[5102] file quarantine or recovery failed. Files to quarantine or recovery already exist" error message is displayed.

Cause

The name that will be changed during file quarantine or recovery is already in use.
Another administrator has accessed the server and recovered the file.

Solution

Access the server and check if there are any files with the name that will be changed during quarantine or recovery.

"[5103] file recovery failed. It is recommended to check the server" error message

"[5103] file recovery failed. It is recommended to check the server" error message is displayed.

Cause

An error occurred during the process of renaming the file to the original file name during recovery.

Solution

Access the server, check for files with the quarantined file name and the name that will be changed during recovery, and assess the situation for appropriate action.

"[5104] file quarantine failed. It is recommended to check the server" error message

"[5104] file quarantine failed. It is recommended to check the server" error message is displayed.

Cause

An error occurred during the process of renaming the file to the quarantined file name.

Solution

Access the server and check the original file.

[5401] WAS process could not be found. Check the WAS execution status. Disable the agent if you do not wish to use it" error message

[5401] WAS process could not be found. Check the WAS execution status. Disable the agent if you do not wish to use it" error message is displayed.

Cause

Agent cannot find WAS process.

Solution

  • If the error occurred while the agent was enabled, execute WAS from the server first and enable the agent again. If the WAS is running but the WAS process cannot be found, it may be an unsupported WAS. Check the service support environment.
  • This error can also occur when the WAS process ends while Agent is being executed normally. In this case, WAS may have been temporarily ended intentionally (for update, etc.), so the agent remains enabled to avoid being exposed to the risk of web shell attacks. Restart the WAS or change the agent to disable.
  • If restarting the WAS does not resolve the issue, disable the agent and then enable it again.
  • If the issue persists even after changing the agent's disable/enable settings, restart the agent on the server as follows.
    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload
    • Agent for Kubernetes
      # kubectl delete -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
# kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
       > %LOCALAPPDATA%/WBDAgent/AgentService.exe exit
> %LOCALAPPDATA%/WBDAgent/AgentService.exe

"[5402] WAS process could not be found. Check the WAS execution status. Disable the agent if you do not wish to use it" error message

"[5402] WAS process could not be found. Check the WAS execution status. Disable the agent if you do not wish to use it" error message is displayed.

Cause

The number of allowed WAS processes has been exceeded on the detected server.

Solution

  • If the error occurred while the agent was enabled, adjust the number of WAS and enable the agent again.

  • This error can also occur when the number of the WAS processes allowed exceeds while Agent is being executed normally. In this case, the number of WAS processes may have been temporarily exceeded, so the agent remains enabled to avoid being exposed to the risk of web shell attacks. However, some features may not work normally.

  • If the error is not fixed after adjusting the number of WAS to be within the allowed number, disable the agent and enable it again.

  • If it is not fixed by disabling/enabling the agent, restart the agent in the server as follows:

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload
    • Agent for Kubernetes
      # kubectl delete -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
# kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe exit
> %LOCALAPPDATA%/WBDAgent/AgentService.exe
Note

If you have set the PHP when registering the detection target server, only one Apache or NGINX is allowed. If you set the JSP, only one Tomcat is allowed.
<Example>: In the nginx environment, the following case is recognized as a single WAS.

nginx: master process
    nginx: worker process
    nginx: worker process
    nginx: worker process

"[5403] cannot access the Access Log file of the WAS process. Some information collection may be omitted. Check Access Log file" error message

"[5403] cannot access the Access Log file of the WAS process. Some information collection may be omitted. Check Access Log file" error message is displayed.

Cause

In a JSP environment, the agent cannot access the WAS Access Log file.

Solution

  • If this occurs when enabling the agent, check if the Access Log file is accessible and then enable the agent again.
  • This error can also occur when you can't access the Access Log while Agent is being executed normally. In this case, the number of WAS processes may have been temporarily exceeded, so the agent remains enabled to avoid being exposed to the risk of web shell attacks. However, we recommend solving the error since some features might not function properly if this error is maintained.
  • If the error is not fixed after taking measures to access the access log, disable the agent and enable it again.
  • If it is not fixed by disabling/enabling the agent, restart the agent in the server.
    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload
    • Agent for Kubernetes
      # kubectl delete -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
# kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe exit
> %LOCALAPPDATA%/WBDAgent/AgentService.exe

"[5404] Inotify limit has exceeded. Refer to user guide" error message

"[5404] Inotify limit has exceeded. Refer to user guide" error message is displayed.

Cause

inotify limit value usage is limited

Solution

Depending on the server environment, the inotify limit value used in the WebShell Behavior Detector service may be restricted. Set the inotify limit value to an appropriate value for your server environment.

  • Check the inotify limit value currently set in the server
    $ cat /proc/sys/fs/inotify/max_user_watches
  • Change inotify limit value temporarily (example)
    $ sudo sysctl fs.inotify.max_user_watches=8192 (desired value)
$ sudo sysctl -p
  • Change inotify limit value permanently (example)
    Add fs.inotify.max_user_watches=100000 (desired value) to the /etc/sysctl.conf file and run sudo sysctl-p.
    $ echo fs.inotify.max_user_watches=100000 | sudo tee -a /etc/sysctl.conf
$ sudo sysctl -p
  • Restart the agent in the server after changing the inotify limit value as follows:
    # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload

"[5405] Cannot access the following path. Some features may not work properly. Check and take action" error message

"[5405] Cannot access the following path. Some features may not work properly. Check and take action" error message is displayed.

Cause

The agent cannot access the required locations for collecting web shell activity (web root path, upload path, Access Log, etc.).

Solution

Take action to allow the agent to access the path specified in the error message.

"[6007] Unable to connect to the agent. Check the agent's running status or the server network" error message

"[6007] Unable to connect to the agent. Check the agent's running status or the server network" error message is displayed.

Cause

Communication with the agent has been lost.

Solution

  • Check the agent's execution status or the detection target server's network status.
  • If the agent is ended, execute the agent as follows:

    • Agent for Linux

      # /opt/nbp/wbd/wbd_agent -s start

    • Agent for Kubernetes

      # kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml

    • Agent for Windows

      > %LOCALAPPDATA%/WBDAgent/AgentService.exe

"[6008] Failed to update the agent. Check the agent's running status or the server network" error message

"[6008] Failed to update the agent. Check the agent's running status or the server network" error message is displayed.

Cause

The update signal was sent to the agent, but the update did not proceed.

Solution

  • Check the agent's execution status or the detection target server's network status. If the agent is ended, execute the agent as follows:

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s start
    • Agent for Kubernetes
      # kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe

  • If the agent is executing normally, end the agent and restart again as follows:

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload
    • Agent for Kubernetes
      # kubectl delete -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
# kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe exit
> %LOCALAPPDATA%/WBDAgent/AgentService.exe

"[6021] The requested command has timed out. Try again later" error message

"[6021] The requested command has timed out. Try again later" error message is displayed.

Cause

The enable/disable or file quarantine/recovery command was sent to the agent, but it timed out.

Solution

  • Check the agent's execution status or the detection target server's network status. If the agent is ended, execute the agent as follows:
    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s start
    • Agent for Kubernetes
      # kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe
  • If the agent is executing normally, end the agent and restart again as follows:
    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload
    • Agent for Kubernetes
      # kubectl delete -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
# kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe exit
 > %LOCALAPPDATA%/WBDAgent/AgentService.exe

"[6023] Unable to connect to the agent. Check the agent's running status or the server network" error message

"[6023] Unable to connect to the agent. Check the agent's running status or the server network" error message is displayed.

Cause

Commands were sent, but the agent could not be connected.

Solution

  • Check the agent's execution status or the detection target server's network status. If the agent is ended, execute the agent as follows:

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s start
    • Agent for Kubernetes
      # kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe

  • If the agent is executing normally, end the agent and restart again as follows:

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload
    • Agent for Kubernetes
      # kubectl delete -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
# kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe exit
> %LOCALAPPDATA%/WBDAgent/AgentService.exe

"[8003] file quarantine commands failed. Check the agent's running status or the server network" error message

"[8003] file quarantine commands failed. Check the agent's running status or the server network" error message is displayed.

Cause

File quarantine commands were sent, but the agent could not be connected.

Solution

  • Check the agent's execution status or the detection target server's network status. If the agent is ended, execute the agent as follows:

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s start
    • Agent for Kubernetes
      # kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe

  • If the agent is executing normally, end the agent and restart again as follows:

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload
    • Agent for Kubernetes
      # kubectl delete -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
# kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe exit
> %LOCALAPPDATA%/WBDAgent/AgentService.exe

"[8004] Invalid request. Proceed after refreshing'" error message

"[8004] Invalid request. Proceed after refreshing" error message is displayed.

Cause

An invalid request was executed, such as requesting the deletion of an already deleted target or handling an exception for a target that is excluded.

Solution

Proceed again after refreshing.
If the same issue persists, contact NAVER Cloud Platform's Customer Support.

"[8005] Invalid request. Proceed after refreshing'" error message

"[8005] Invalid request. Proceed after refreshing" error message is displayed.

Cause

The requested value is invalid.

Solution

Refresh and verify if a valid data request has been made.
If the same issue persists, contact NAVER Cloud Platform's Customer Support.

"[8008] The file has already been quarantined/recovered. Proceed after refreshing'" error message

"[8008] The file has already been quarantined/recovered. Proceed after refreshing" error message is displayed.

Cause

The file that has already been quarantined was requested for quarantine, or the file that has already been recovered was requested for recovery.

Solution

Proceed again after refreshing.
If the same issue persists, contact NAVER Cloud Platform's Customer Support.

"[8009] file recovery commands failed. Check the agent's running status or the server network" error message

"[8009] file recovery commands failed. Check the agent's running status or the server network" error message is displayed.

Cause

The file recovery command was sent, but the agent could not be connected.

Solution

  • Check the agent's execution status or the detection target server's network status. If the agent is ended, execute the agent as follows:

    # /opt/nbp/wbd/wbd_agent -s start

  • If the agent is executing normally, end the agent and restart again as follows:

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload
    • Agent for Kubernetes ]
      # kubectl delete -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
# kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe exit
> %LOCALAPPDATA%/WBDAgent/AgentService.exe

"[8010] Failed to send the agent enable command. Check the agent's running status or the server network" error message

"[8010] Failed to send the agent enable command. Check the agent's running status or the server network" error message is displayed.

Cause

The file enable command was sent, but the agent could not be connected.

Solution

  • Check the agent's execution status or the detection target server's network status. If the agent is ended, execute the agent as follows:

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s start
    • Agent for Kubernetes
      # kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe

  • If the agent is executing normally, end the agent and restart again as follows:

    • Agent for Linux

      # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload

    • Agent for Kubernetes

      # kubectl delete -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
# kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml

    • Agent for Windows

      > %LOCALAPPDATA%/WBDAgent/AgentService.exe exit
> %LOCALAPPDATA%/WBDAgent/AgentService.exe

"[8012] The range that can be queried or accessed at once has been exceeded. Proceed by adjusting the search period or conditions" error message

"[8012] The range that can be queried or accessed at once has been exceeded. Proceed by adjusting the search period or conditions" error message is displayed.

Cause

The range that can be viewed at once (10,000 items) has been exceeded.

Solution

Set the query view conditions to adjust within the allowed range. The range that can be viewed at once is 10,000 items.
If the same issue persists, contact Customer Support through the NAVER Cloud Platform portal.

"[8013] The modified detection target setting information was sent, but it failed. Check the agent's running status or the server network" error message

"[8013] The modified detection target setting information was sent, but it failed. Check the agent's running status or the server network" error message is displayed.

Cause

The modified detection target setting information was sent, but the agent could not be connected.

Solution

  • Check the agent's execution status or the detection target server's network status. If the agent is ended, execute the agent as follows:

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s start
    • Agent for Kubernetes
      # kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe

  • If the agent is executing normally, end the agent and restart again as follows.

    • Agent for Linux
      # /opt/nbp/wbd/wbd_agent -s stop
# /opt/nbp/wbd/wbd_agent -s start
or 
# /opt/nbp/wbd/wbd_agent -s reload
    • Agent for Kubernetes
      # kubectl delete -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
# kubectl apply -f https://wbd.ncloud.com:18088/agent/wbd_agent_ds.yaml
    • Agent for Windows
      > %LOCALAPPDATA%/WBDAgent/AgentService.exe exit
> %LOCALAPPDATA%/WBDAgent/AgentService.exe

"[8023] Unable to find the web server environment/path settings for the Pod" error message

"[8023] Unable to find the web server environment/path settings for the Pod" error message is displayed.

Cause

The web root/upload path for the Kubernetes Pod has not been registered.
The web root/upload path for the Kubernetes Pod was incorrectly entered or an inaccessible path was specified.

Solution

Check the web root/upload path for the Kubernetes Pod.

Business Registration Number: 129-86-31394 E-commerce Permit Number:No. 2009-GyeonggiSeongnam-0510
CEO: Kim Yuwon Address: NAVER Green Factory 17th–26th Floors, Buljeong-ro 6, Bundang-gu, Seongnam-si, Gyeonggi-do 13561, Republic of Korea. Customer Support Number: 1544-5876
© NAVER Cloud Corp. All Rights Reserved.