Cb Response: Linux Sensor with glusterfs volumes creates problem

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

The following types of glusterfs warning errors get logged on an endpoint running CbR when accessing files on the glusterfs volume.

W [MSGID: 114031] [client-rpc-fops.c:3047:client3_3_readv_cbk] 0-gv0-client-1: remote operation failed [Bad file descriptor] W [MSGID: 114031] [client-rpc-fops.c:3047:client3_3_readv_cbk] 0-gv0-client-0: remote operation failed [Bad file descriptor] W [fuse-bridge.c:2192:fuse_readv_cbk] 0-glusterfs-fuse: 68: READ => -1 (Bad file descriptor) W [MSGID: 114031] [client-rpc-fops.c:3047:client3_3_readv_cbk] 0-gv0-client-1: remote operation failed [Bad file descriptor] W [MSGID: 114031] [client-rpc-fops.c:3047:client3_3_readv_cbk] 0-gv0-client-0: remote operation failed [Bad file descriptor] W [fuse-bridge.c:2192:fuse_readv_cbk] 0-glusterfs-fuse: 69: READ => -1 (Bad file descriptor) *no* further _formatting_ is done here

And the following types of error messages get logged on the glusterfs server(s).

E [MSGID: 113040] [posix-inode-fd-ops.c:1522:posix_readv] 0-gv0-posix: read failed on gfid=ea9605f5-c264-4806-9b31-a1de14c821c0, fd=0x7f8434003d28, offset=0 size=131072, buf=0x7f84644ee000 [Bad file descriptor] E [MSGID: 115068] [server-rpc-fops.c:1489:server_readv_cbk] 0-gv0-server: 163: READV 1 (ea9605f5-c264-4806-9b31-a1de14c821c0), client: PCVM-EA11820-GfsCli-CentOS72-7328-2018/08/16-17:32:08:114224-gv0-client-0-0-0, error-xlator: gv0-posix [Bad file descriptor]

Environment

• Cb Response Sensor: All versions
• Linux: All supported versions

Cause

vfs_read() from kernel is invalid

Resolution

Upgrade to Linux sensor version 6.1.11 or 6.2.3 and above