EDR: Out of License Message from Sensors
search cancel

EDR: Out of License Message from Sensors

book

Article ID: 285739

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Out of License health score messages 

Environment

  • Carbon Black Response Sensor: All Versions
  • Linux: All Supported Versions
  • macOS: All Supported Versions

Cause

Busy CB EDR server might not return a response to the sensor during a license validity check 

Resolution

  • Restart the sensor service to clear the message.
    • This can be done via the console under the Actions panel
    • By script using this command "sudo service cbdaemon restart" and method of deployment choice
    • Via CbAPI. Download: Out_Of_License_Restart.py
      # provides dryrun before restarting
      Out_Of_License_Restart.py -d
      # restart sensors
      Out_Of_License_Restart.py 
      • This script is a modified version of the restart_sensors.py and made specifically for this error message. 
  • CB-31080 is in progress to check sensor side

Additional Information

  • License is enforced on the server side. This specific message does not affect the sensors sending up data with a score of -25. Other healthchecks along with it will have a higher score, at that time more investigation would be needed. 
  • The health score does not update after getting a successful validity check, restarting sensor services clears the healtcheck

Attachments

Out_Of_License_Restart.py get_app