Support Center > Search Results > SecureKnowledge Details
"IOC_FAILED_WHILE_PARSING" error message when Custom Intelligence Feeds automatic process fails after editing source file Technical Level
Symptoms
  • "IOC_FAILED_WHILE_PARSING" error message when Custom Intelligence Feeds automatic process fails after editing source file.
    When adding an IP address, or domain, to the list, the system does not block the new address (still blocks the existing entries), and shows a parsing error: "IOC_FAILED_WHILE_PARSING"
  • If you manually push the update using "ioc_feeds push" on the Security Gateway, the system successfully loads the file, and blocks all the entries, including the new ones.
  • Debug and ioc command outputs indicate "Feed format problem", even though the format is as expected/required for the product:
    #############################################
    Feed status ip_list :: IOC_SUCCESS
    #############################################
    Feed status domain_list :: IOC_SUCCESS
    #############################################
    Feed status ip_list :: IOC_SUCCESS
    #############################################
    Feed status domain_list :: IOC_FAILED_WHILE_PARSING
    #############################################
    Feed log External IOC - Partial success
    ip_list: Success
    domain_list: Feed format problem. Feed format not supported

  • When adding/deleting an entry from the source file, $FWDIR/log/ioc_feeder.elg may show:
    ############## FAILED ##############
    #############################################
    Feed status ip_test :: engine memory allocation error
    #############################################
    Feed log External IOC - External Indicators processing failed
    ip_test: Feed format problem. Feed format not supported
Solution
Note: To view this solution you need to Sign In .