Troubleshooting

This section describes possible problems in the operation of Kaspersky MLAD and methods for resolving them.

When connecting to Kaspersky MLAD, the browser displays a certificate warning

Problem

When attempting to connect to Kaspersky MLAD, the browser displays a warning that the security certificate or the established connection is not trusted. The contents of the warning depend on the specific browser being used.

Solution

After Kaspersky MLAD is installed, a self-signed certificate is used by default to connect to the web interface. When using a self-signed certificate, the browser displays a warning that the security certificate or the connection being established is not trusted. To obtain a trusted certificate, you need to contact the information security department or the information technology department of the Customer. To install the received trusted certificate, you need to contact a qualified technical specialist of the Customer, a Kaspersky employee, or a certified integrator. An employee can update certificates for connecting to Kaspersky MLAD using the web interface.

You can temporarily use a self-signed certificate to connect to Kaspersky MLAD (for example, during trial operation). When using a self-signed certificate, in the browser warning window select the option that lets you continue connecting. After connecting to Kaspersky MLAD, the browser window displays a warning about the certificate. The text of the message depends on the specific browser being used.

If the browser displays a warning after a trusted certificate is installed, then the certificate may have been spoofed by a malicious actor. Contact the Technical Support.

The hard drive is running out of free space

Problem

The hard drive of the computer where Kaspersky MLAD is installed is running out of free disk space.

Solution

The computer must meet the hardware and software requirements to ensure proper functioning of the application.

Do not allow the hard drive to completely run out of free disk space. Periodically check for free space by using the df -h command.

To ensure that the application functions properly:

On the hard drive of the computer, free up sufficient space to satisfy the minimum free disk space requirements. You can free up space on the hard drive in the following ways:

• Move backup copies of Kaspersky MLAD, the Kaspersky MLAD distribution package and extraneous files to another drive or server.
• Create an image of the drive on which Kaspersky MLAD is installed, replace the hard drive with a larger one, and deploy the image on the new drive.

The operating system restarted unexpectedly

Problem

Unexpected restart of a computer with Kaspersky MLAD installed.

Solution

Wait for the computer restart to finish. After the computer has restarted, the following statuses of Kaspersky MLAD are possible:

• Kaspersky MLAD has fully resumed normal operation.
• Kaspersky MLAD has not resumed normal operation.

If the problem persists, restart Kaspersky MLAD. If the problem is not resolved after the restart, please contact Kaspersky Technical Support. Be prepared to submit process logs of Kaspersky MLAD and other data when requested by Technical Support representatives. Process logs are located in the directories listed in the Folders for storing application data article. Root privileges in the operating system are required for providing access to logs.

Cannot connect to the Kaspersky MLAD web interface

Problem

Error! is displayed after entering a valid password to sign in to the Kaspersky MLAD web interface. Invalid server error.

Solution

Often, the error Error! Invalid server error occurs when the Kaspersky MLAD server cannot process a request. For example, this could happen if the hard drive of the server where the application is installed has run out of free space.

To restore proper operation:

On the hard drive of the server, free up sufficient space to satisfy the minimum free disk space requirements. You can free up space on the hard drive in the following ways:

• Move backup copies of Kaspersky MLAD, the Kaspersky MLAD distribution package and extraneous files to another drive or server.
• If Kaspersky MLAD is installed on a virtual machine, increase the size of the virtual hard drive of the virtual machine.
• Create an image of the drive on which Kaspersky MLAD is installed, replace the hard drive with a larger one, and deploy the image on the new drive.

Data graphs or graphic areas are not displayed in the History and Monitoring sections

Problem

The History and Monitoring sections are not displaying data graphs or graphic areas.

This may be caused by the following:

• Presets were not imported into Kaspersky MLAD.
• The selected preset contains no tags.
• No graphic areas are defined in the selected preset.
• Time interval with no data is selected in the History section.
• The connector used to receive data from the monitored asset is not running.
• The monitored asset is powered off.

Solution

Import or create presets that contain tags and graphic areas.

To display data in the Monitoring section, make sure that the monitored asset is enabled. Enable the connector used to receive data from the monitored asset. Select a time interval and preset.

To display data in the History section, select a preset, date and time interval in which data on preset tags is available.

Events are not transmitted between Kaspersky MLAD and external systems

Problem

Events are not received by Kaspersky MLAD and/or alerts about the monitor activation are not sent to external systems.

Solution

To restore the exchange of events with external systems:

1. Start the Event Processor service and the CEF Connector.
2. When configuring the Event Processor service, do the following:
   1. In the Event processor configuration file field, upload the configuration file describing the event parameters.
   2. In the Interval for receiving batch events (sec.) field, specify the time interval in seconds required to generate an episode, taking into account the speed of receiving events from the monitored asset.
3. To receive events in the .env file, specify the IP address and port number used to connect to the external event source.
4. To send events, when configuring the CEF Connector, specify the IP address and the port number for connecting to the external system.

Cannot load data to view in the Event Processor section

Problem

After restarting Kaspersky MLAD, it is impossible to upload data for viewing the events history and/or pattern history in the Event Processor section (the Process request button is not available). This problem also arises after changing the settings of the Event Processor service.

Solution

Wait a few minutes. After Kaspersky MLAD is restarted, the state of the Event Processor service is restored. It may take several minutes to restore the state of the service if there is a significantly large number of processed events or registered patterns. Until the state of the Event Processor service is restored in the Event Processor section, requests are not fulfilled, data is not updated, and data received from the CEF Connector is not processed. This data is temporarily stored in the system message queue and is processed after the state of the Event Processor service is restored.

Data is incorrectly processed in the Event Processor section

Problem

A large number of short patterns is being created.

Solution

In the Event Processor settings, increase the episode length to reduce the number of short patterns being registered.

Problem

A large number of monitor activation alerts is being received.

Solution

To reduce the number of monitor activation notifications, check previously created monitors and delete the ones you do not need. It is also recommended to update the following monitor activation parameters: Sliding window and Threshold.

Events are not displayed in the Event Processor section

Problem

When you make a request to view the event history, the Event Processor → Event history section does not display the events that were displayed before.

Solution

Make sure that Kaspersky MLAD saves the state of the Event Processor service to the database table.

If the state of the Event Processor service is saved to a file in bit format, Kaspersky MLAD saves the state of the service with the frequency specified in the Component backup frequency field. When the Event Processor service is restarted, the results of processing of the event stream received by the Event Processor since the last time the service state was saved are lost.

Previously created monitors and the specified attention settings are not displayed in the Event Processor section

Problem

After restarting or modifying the Event Processor service settings, the Event Processor → Monitoring section does not display previously created monitors and the specified attention settings.

Solution

The Event Processor saves the created monitors and the specified attention settings after saving the state of the Event Processor service to a database table or a file in bit format. If Kaspersky MLAD saves the state of the service to a database table, it is recommended not to restart the Event Processor service or change its settings until the first episode of events from the monitored asset is processed, in order to save the created monitors and the specified attention settings. If the application saves the state of the Event Processor service to a file in bit format, it is recommended not to restart the Event Processor service or change its settings until the first backup of the service, in order to save the created monitors and the defined attention settings. The frequency of the Event Processor service backups depends on the value of the Component backup frequency setting.

To receive events, configure the settings and start the Event Processor service and the CEF Connector. To process the registered incidents as events, configure and start the Anomaly Detector service and the connector required to receive telemetry data from the monitored asset. Go to the Dashboard section and make sure that events are received by Kaspersky MLAD in the online mode.

If the malfunction persists, please contact Kaspersky Technical Support.

A markup result is not displayed

Problem

In the Models section, when viewing the markup graph, the data intervals to be selected by the markup appear uncolored.

Solution

The selected time interval may be too short and may not contain enough data for the markup to display the data intervals on the graph. In the Scale field, specify a longer time interval to display data on the markup graph.

A Trainer service stopped message is displayed

Problem

When you go to the Training tab of an ML model element, you see the Trainer service is stopped message. The Trainer service was started by a system administrator or a user with the Manage statuses of application services permission from the Working with application services permission group.

Solution

Wait approximately two seconds. If the Trainer service is running, the message will disappear automatically.

Training of an ML model element completed with an error

Problem

Training of an ML model element completed with an error. A training error may appear both immediately after training start and after several training epochs are completed.

Solution

If the training of an ML model element completed with an error immediately after training start, make sure that there is data available for all ML model tags within the training interval specified in the Data selection interval setting, while considering markup (

learning indicator

A set of criteria used to determine the data time intervals on which the ML model performs the training.

If the training of an ML model element ended with an error after the training lasted for some time, this means that the selected architecture of the element, parameters of the element, or parameters of training the element are not suitable for accomplishing your task with the available data because the target quality metrics of the ML model cannot be achieved. Try to use an element of a different type or architecture, or change the element parameters or its training parameters.

Email notifications about incidents are not being received

Problem

Email notifications about incidents are not being received.

Solution

Make sure that interaction between Kaspersky MLAD and the SMTP server is configured correctly and that the Mail Notifier service is running. Create an incident notification and specify the email addresses and types of incidents for which you need to send notifications. Use the State toggle switch to enable forwarding of notifications.

You need to change the Help localization language

Problem

The Help localization language must be changed in the Kaspersky MLAD web interface.

To change the Help localization language, visit the Technical Support website at https://support.kaspersky.com/ select the required language in the upper right corner of the page.

Solution

To change the Help localization language in the application web interface:

1. Open the browser installed on your computer.
2. In the address bar of the browser, enter the web address of Kaspersky MLAD received from a qualified technical specialist of the Customer, a Kaspersky specialist, or a certified integrator.
3. To open Help, perform one of the following actions:
   • In the upper-right corner of the account credentials entry page that opens, click the Help link.
   • On the login page, enter your user name and password, and click in the lower left corner of the page that opens.

   A new browser tab opens displaying the application Help.

4. Specify the necessary localization language in the web address:
   • ru – if you want to open Help in Russian (for example, https://<Kaspersky MLAD web address>/help/ru/171583.htm).
   • en – if you want to open Help in English (for example, https://<Kaspersky MLAD web address>/help/en/171583.htm).

After connecting to the application, you can change the language of the interface and Help in the user menu.