Error: Ingest Module Startup Failure (Yara Analyzer)

Autopsy Help
1

I am a new user and I have a roadblock while trying conduct analysis on some files.
After a fresh installation (uninstall and reinstall) , I am still getting the below error related to Yara compilation.

Message error:

"Unable to start up one or more ingest modules, ingest cancelled
Please disable the failed modules or fix the errors before restarting ingest.

Error:
Yara Analyzer: Failed to compile Yara rules file: <path-to-file/file.yar> Compile error 1"

autopsy.log file:
SEVERE: Error starting YARA Analyzer ingest module for job 5
org.sleuthkit.autopsy.ingest.IngestModule$IngestModuleException: Failed to compile Yara rules file C:\Users<path-to-file>\file.yar. Compile error 1
org.sleuthkit.autopsy.modules.yara.YaraIngestHelper.compileRuleSet(YaraIngestHelper.java:250)
org.sleuthkit.autopsy.modules.yara.YaraIngestHelper.compileRules(YaraIngestHelper.java:79)
org.sleuthkit.autopsy.modules.yara.YaraIngestModule.startUp(YaraIngestModule.java:101)
org.sleuthkit.autopsy.ingest.IngestTaskPipeline$PipelineModule.startUp(IngestTaskPipeline.java:422)
org.sleuthkit.autopsy.ingest.IngestTaskPipeline.startUpIngestModules(IngestTaskPipeline.java:162)
org.sleuthkit.autopsy.ingest.IngestTaskPipeline.startUp(IngestTaskPipeline.java:114)
org.sleuthkit.autopsy.ingest.IngestJobPipeline.startUpIngestModulePipeline(IngestJobPipeline.java:670)
org.sleuthkit.autopsy.ingest.IngestJobPipeline.startUpIngestModulePipelines(IngestJobPipeline.java:647)
org.sleuthkit.autopsy.ingest.IngestJobPipeline.startUp(IngestJobPipeline.java:563)
org.sleuthkit.autopsy.ingest.IngestJob.start(IngestJob.java:207)
org.sleuthkit.autopsy.ingest.IngestManager.startIngestJob(IngestManager.java:492)
org.sleuthkit.autopsy.ingest.IngestManager$StartIngestJobTask.call(IngestManager.java:986)
org.sleuthkit.autopsy.ingest.IngestManager$StartIngestJobTask.call(IngestManager.java:947)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)

Could you please assist me to address this issue ?
I need Yara Rules to be run and process files on my Autopsy instance.
Thank you in advance.

2

It appears to be failing when running the command “yarac (your rules file) (compiled rules output)”. Are you sure your rules file is the correct format and readable by Autopsy?

3

Yes, the yara rule file is on the correct format, as I have checked it on another computer also (friend of mine), running the same version of Autopsy. Even thought the module was run properly there, he faces issue while trying to search for and see the results on the left main results menu (none relative YARA icon appears there, thus he cannot view results).
Do you know how I could test the compilation process of yara rules outside of the Autopsy and if this will help me out to identify the issue ?

4

Hi. If you would like to test the rule file outside of Autopsy you can download the Yara tool from https://github.com/VirusTotal/yara/releases

Instructions for running the Yara command line tool can be found here: Running YARA from the command-line — yara 4.2.0 documentation

Can you provide the rule file?