DXL Client dxl_service.log : [Error] DxlState: Broker list is empty

[iverbuyst]

Hello,

We're using 2 TIE/DXL Servers in 1 hub  and 1 DXL Broker in DMZ. In the DXL topology everything looks fine. We did a TIE test by changing the reputation of 1 file this is replicated immediately to the client (checked in ATP logs) and the Agent-Info on the client shows DXL connection Status : Connected and the correct broker name. So we think the DXL communication is working fine but in the dxl_service.log we notice DXLState :  Broker list is empty. The dxl_property.config shows all parameters filled in but in dxl_local.config the broker list and the ConnectedBroker info is empty  

Is this normal behaviour and can we ignore this message or is there a fault in the configuration.

2021-07-02 10:48:30.217 [P6][Information] DxlConnection: connectBroker: attempting to connect to a broker with sorted list
2021-07-02 10:48:30.217 [P6][Information] DxlConnection: connectBroker: connect to broker xxxxxxxxx:{xxxxx} with url = ssl://xxx.xxx.xxx.xxx:8883
2021-07-02 10:48:30.392 [P6][Information] DxlConnection: MQTTClient_connect succeeded for url = ssl://xxx.xxx.xxx.xxx:8883
2021-07-02 10:54:03.524 [P15][Warning] DxlState: failed to get selected affinity node
2021-07-02 10:54:03.524 [P15][Warning] DxlState: failed to get broker parents
2021-07-02 10:54:03.524 [P15][Warning] DxlState: failed to get affinity brokers
2021-07-02 10:54:03.524 [P15][Error] DxlState: Broker list is empty

The "[P15][Warning] DxlState:" and "[P15][Error] DxlState:" appear in the log every time the policies are applied.

Best Regards,

[iverbuyst]

This is a part of the dxl_service.log in debug mode. Here you can see that it uses dxl_local.conf in which the dxl broker list is empty.

2021-07-02 13:08:23.546 [P15][Debug] DxlConnection: updatePropertiesLock...
2021-07-02 13:08:23.546 [P15][Debug] DxlState: load properties file 'C:\ProgramData\McAfee\Data_Exchange_Layer\dxl_local.config'
2021-07-02 13:08:23.547 [P15][Debug] DxlController: Config file 'C:\ProgramData\McAfee\Data_Exchange_Layer\dxl_local.config' was loaded. Number of entries: 20
2021-07-02 13:08:23.547 [P15][Debug] DxlState: loadProperties
2021-07-02 13:08:23.548 [P15][Debug] DxlState: debug logging: 1
2021-07-02 13:08:23.548 [P15][Debug] DxlState: read system guid: {123456789}
2021-07-02 13:08:23.548 [P15][Debug] DxlState: system guid: {123456789}
2021-07-02 13:08:23.548 [P15][Debug] DxlState: client version: 6.0.3.356
2021-07-02 13:08:23.548 [P15][Debug] DxlState: tenant guid: n/a
2021-07-02 13:08:23.548 [P15][Debug] DxlState: broker list:
2021-07-02 13:08:23.548 [P15][Debug] DxlState: broker cert chain path: C:\ProgramData\McAfee\Data_Exchange_Layer\DxlBrokerCertChainLocal.pem
2021-07-02 13:08:23.548 [P15][Debug] DxlState: cert path: C:\ProgramData\McAfee\Data_Exchange_Layer\DxlClientCertLocal.pem
2021-07-02 13:08:23.548 [P15][Debug] DxlState: key file path: C:\ProgramData\McAfee\Data_Exchange_Layer\DxlPrivateKeyLocal.pem
2021-07-02 13:08:23.548 [P15][Debug] DxlState: keep alive: 30
2021-07-02 13:08:23.548 [P15][Debug] DxlState: cert version: 0
2021-07-02 13:08:23.548 [P15][Debug] DxlState: cert version policy: 0
2021-07-02 13:08:23.548 [P15][Debug] DxlState: useSSl 1
2021-07-02 13:08:23.548 [P15][Debug] DxlState: useAAC 1
2021-07-02 13:08:23.548 [P15][Warning] DxlState: failed to get selected affinity node
2021-07-02 13:08:23.548 [P15][Warning] DxlState: failed to get broker parents
2021-07-02 13:08:23.548 [P15][Warning] DxlState: failed to get affinity brokers
2021-07-02 13:08:23.549 [P15][Error] DxlState: Broker list is empty
2021-07-02 13:08:23.549 [P15][Debug] DxlAffinityUtil: No reconnect required for affinity
2021-07-02 13:08:23.549 [P15][Debug] DxlConnection: update properties complete, resetMQTT 1 resetConn 1
2021-07-02 13:08:23.549 [P15][Debug] DxlConnection: addEvent type 1
2021-07-02 13:08:23.549 [P15][Debug] DxlConnection: properties state valid 0
2021-07-02 13:08:23.549 [P15][Debug] DxlConnection: ...updatePropertiesLock
2021-07-02 13:08:23.549 [P13][Debug] DxlConnection: getEvent type 1
2021-07-02 13:08:23.549 [P13][Debug] DxlConnection: backlog 0
2021-07-02 13:08:23.549 [P13][Debug] DxlConnection: configuration state is not valid, leaving MQTT disabled
2021-07-02 13:08:23.549 [P15][Debug] DxlServiceTimerThread: Waiting for valid broker list to issue local certificate request
2021-07-02 13:08:24.566 [P15][Debug] DxlServiceTimerThread: checking internal connection
2021-07-02 13:08:24.567 [P15][Debug] DxlServiceTimerThread: checking internal local connection

[cdinet]

From one of our dxl experts:

The message can be ignored so long as the DXL client has an active, established connection to a DXL broker. This can be checked by right clicking on the McAfee Agent Tray Icon and selecting "about" and viewing the DXL status, or by selecting the system from ePO and selection actions > lookup up in DXL

The DXL client pulls the broker list from the ma policy.db and the broker list is stored in the dxl_property.config file

dxl_local.config is only used in OpenDXL implementations, and in a future release of DXL the message "Broker list is empty" will be suppressed when the client has an established broker connection.