EDR Server: Services Not Stopped Cleanly on Reboot or Shutdown Commands
search cancel

EDR Server: Services Not Stopped Cleanly on Reboot or Shutdown Commands

book

Article ID: 285947

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • When issuing reboot now or shutdown now commands, system reboots too quickly, not allowing EDR Server services to shutdown cleanly.

Environment

  • EDR Server Server: 6.x or Greater
  • CentOS 7.x

Cause

  • Services do not stop cleanly in all CentOS7.x EDR Server 6.x servers.

Resolution

  • This issue is fixed in EDR Server 7.0.0 build.
  • Workaround for EDR 6.x server versions : 
    • Run the following command to create a SystemD unit file for the cb-enterprise service : 
systemctl edit --full cb-enterprise.service
  • The command above creates the following service unit file in /etc/systemd/system/ :
[Unit]
Documentation=man:systemd-sysv-generator(8)
SourcePath=/etc/rc.d/init.d/cb-enterprise
Description=SYSV: Carbon Black is a surveillance camera for your computer -- always recording so you know precisely what happened and where. This component provides an internal interface to the primary datastore.
Before=runlevel2.target
Before=runlevel3.target
Before=runlevel4.target
Before=runlevel5.target
Before=shutdown.target
After=network-online.target
After=network.service
Conflicts=shutdown.target

[Service]
Type=forking
Restart=no
TimeoutSec=5min
IgnoreSIGPIPE=no
KillMode=process
GuessMainPID=no
RemainAfterExit=yes
ExecStart=/etc/rc.d/init.d/cb-enterprise start
ExecStop=/etc/rc.d/init.d/cb-enterprise stop
ExecReload=/etc/rc.d/init.d/cb-enterprise reload
  • Type :wq! to save the file
  • Run the following command to enable the service unit:
systemctl enable cb-enterprise
  • When running shutdown/reboot now commands the shutdown should wait on the services to stop first before the instance goes down.

Additional Information

  • To verify services are stopping properly, enable persistent logging in /etc/systemd/journald.conf . Update the file, removing the comment character (#) with the following parameter value:
    • Storage=persistent
  • Once updated, restart the journalctl service : 
    • systemctl restart systemd-journald.service
  • To check if services stopped gracefully, post reboot:
    • journalctl -u cb-enterprise
  • Note: Revert once testing is complete to avoid excessive log files.