CB Response: Linux 6.1.9 sensor daemon process crashing

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Linux Sensor showing as Offline in the CB Response web console
• Sensor appears Offline again after restarting daemon service

Environment

• CB Response Linux Sensor: 6.1.9
• Linux: All Supported Versions

Cause

This is a known issue (CB-24303) where the Linux sensor daemon service stops unexpectedly.

Resolution

1. Edit /etc/rc.d/init.d/cbdaemon
2. Add the following lines directly above # start daemon:

+ export MALLOC_CHECK_=0
+

The entry should look like:

# Kernel module check/start, has to be chcked here as .modules can't copy files for upgrades 
/etc/sysconfig/modules/cbresponse.modules

    + export MALLOC_CHECK_=0
    +
    # start daemon
    daemon $DAEMON
    RETVAL=$?

3. Restart the cbdaemon

# service cbdaemon restart

 

Additional Information

• This issue is resolved in CB Response Linux sensor 6.1.10 and later. 
• This known issue is tracked as CB-24303.