EDR Server: Services Not Stopped Cleanly on Reboot or Shutdown Commands

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• When issuing reboot now or shutdown now commands, system reboots too quickly, not allowing EDR Server services to shutdown cleanly.

Environment

• EDR Server Server: 6.x or Greater
• CentOS 7.x

Cause

• Services do not stop cleanly in all CentOS7.x EDR Server 6.x servers.

Resolution

• This issue is fixed in EDR Server 7.0.0 build.
• Workaround for EDR 6.x server versions : 
  • Run the following command to create a SystemD unit file for the cb-enterprise service : 

systemctl edit --full cb-enterprise.service

• The command above creates the following service unit file in /etc/systemd/system/ :

[Unit]
Documentation=man:systemd-sysv-generator(8)
SourcePath=/etc/rc.d/init.d/cb-enterprise
Description=SYSV: Carbon Black is a surveillance camera for your computer -- always recording so you know precisely what happened and where. This component provides an internal interface to the primary datastore.
Before=runlevel2.target
Before=runlevel3.target
Before=runlevel4.target
Before=runlevel5.target
Before=shutdown.target
After=network-online.target
After=network.service
Conflicts=shutdown.target

[Service]
Type=forking
Restart=no
TimeoutSec=5min
IgnoreSIGPIPE=no
KillMode=process
GuessMainPID=no
RemainAfterExit=yes
ExecStart=/etc/rc.d/init.d/cb-enterprise start
ExecStop=/etc/rc.d/init.d/cb-enterprise stop
ExecReload=/etc/rc.d/init.d/cb-enterprise reload

• Type :wq! to save the file
• Run the following command to enable the service unit:

systemctl enable cb-enterprise

• When running shutdown/reboot now commands the shutdown should wait on the services to stop first before the instance goes down.

Additional Information

• To verify services are stopping properly, enable persistent logging in /etc/systemd/journald.conf . Update the file, removing the comment character (#) with the following parameter value:
  • Storage=persistent
• Once updated, restart the journalctl service : 
  • systemctl restart systemd-journald.service
• To check if services stopped gracefully, post reboot:
  • journalctl -u cb-enterprise
• Note: Revert once testing is complete to avoid excessive log files.