EDR: Out of License Message from Sensors

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Out of License health score messages 

Environment

• Carbon Black Response Sensor: All Versions
• Linux: All Supported Versions
• macOS: All Supported Versions

Cause

Busy CB EDR server might not return a response to the sensor during a license validity check 

Resolution

• Restart the sensor service to clear the message.
  • This can be done via the console under the Actions panel
  • By script using this command "sudo service cbdaemon restart" and method of deployment choice
  • Via CbAPI. Download: Out_Of_License_Restart.py

    # provides dryrun before restarting
    Out_Of_License_Restart.py -d
    # restart sensors
    Out_Of_License_Restart.py 

    • This script is a modified version of the restart_sensors.py and made specifically for this error message. 
• CB-31080 is in progress to check sensor side

Additional Information

• License is enforced on the server side. This specific message does not affect the sensors sending up data with a score of -25. Other healthchecks along with it will have a higher score, at that time more investigation would be needed. 
• The health score does not update after getting a successful validity check, restarting sensor services clears the healtcheck