Snare Server Advisory – Hyper-V

SUMMARY

Nov 04, 2016

We have been made aware of a potential file system corruption issue that the Snare Server can have when running on a Hyper-V system, in particular on the 2012r2 platform. The issue has manifested since Microsoft released some patches in October 2016. The issue may result in the system booting up with a read only file system. If you do experience a problem with your Snare Server it may require the system be rebooted into single user mode and then have a corrective fsck performed on the file system to fix the file system corruption. This issue has only appeared for customers running v7.1.1 to date, but could occur for earlier versions. The current patch level of v7.1.2 has later operating system patches which may compensate for these other Microsoft patches as this version has been stable over the same time period.

If you are running your Snare Server in a Hyper-V environment you should patch your system to v7.1.2 as soon as possible to help avoid this file system corruption.

As always we recommend that customers perform a snapshot/checkpoint backup of their Snare Server systems at least daily (or before any major change), or have some other method of system backup so that a system can be recovered in the event of a system failure or corruption and minimise the chance of data loss.