EDR: Job-runner Logs Missing Cron Jobs

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Solr cores are not optimizing.
• /var/log/cb/job-runner/jog-runner.log only contains ondemand_cbdiag_check entries.
• The 'chage -l cb' command lists 'Password expires' and/or 'Account expires' with dates in the past.

Environment

• EDR Server: All versions

Cause

The 'cb' user account password expiration and/or account expiration dates may have expired which block the cb account from running necessary processes or create files.

Resolution

1. Log into each cluster node (primary + secondary servers) as the root user.
2. Set the 'cb' user account back to the default settings of a nologin account without expiration dates.

chage -E -1 cb
chage -M -1 cb
chage -l cb

The expected output of the 'chage -l cb' command should be similar to:

# chage -l cb
Last password change				: Jan 22, 2020
Password expires					: never
Password inactive					: never
Account expires						: never
Minimum number of days between password change		: -1
Maximum number of days between password change		: -1
Number of days of warning before password expires	: -1

3. Confirm cb user settings in /etc/passwd

cb:x:<uid>:<gid>:Service account for VMware Carbon Black EDR:/var/cb:/sbin/nologin

4. Restart the cluster. 

Additional Information

• The 'cb' user account is used to run the solr_optimize, watchlist, etc cronjobs.  Some security guidelines (e.g. STIG) require password expirations and/or account expirations.  They are necessary for login accounts, not nologin accounts.
• The 'cb' user account, required to run EDR, is a nologin account and the password and account should be set to never expire.
• The 'cb' user account should not be used for any other purpose but to run EDR.  If another non-root user is needed requiring non-root shells and account expiration dates please create another account. See the VMware EDR Cluster Management Guide for details.
• The Resolution steps above should be run on all nodes, primary + secondary servers.