Troubleshooting Console Unavailability

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Errors when launching App Control Console, potentially similar to one of the following:

• The Carbon Black App Control console cannot connect to the database. Ensure that the database server is running.
• Network error while trying to communicate with Carbon Black App Control Server
• Error: Could not connect to host
• ERR_CONNECTION_RESET, ERR_ABORTED or similar error message

Environment

• App Control Console: All Supported Versions
• Microsoft Windows Server: All Supported Versions

Cause

• Network connectivity to SQL server has been disrupted (Two Tier Environments)
• SQL Server services are not running or SQL role permissions are missing
• App Control Server/App Control Reporter service password was changed
• IIS DefaultAppPool identity is not correctly set
• CB SQL Server not meeting OER
• Das DB was changed to a different SQL Instance without reinstalling App Control application
• ParityServer.exe is having a NAME COLLISION error on the existing .tmp files in the AppData temp folder
• Other

Resolution

1. Log in to the application server hosting the Console as the Carbon Black Service Account.
2. Verify whether the Console can be accessed locally from the App Control server by going to: https://localhost/login.php
   • If this works, it could indicate there may be a networking/DNS misconfiguration.
   • Verify IPv6 is enabled (disabling it could also negatively affect performance).
3. Verify the IIS Certificate bound in IIS is still valid.
4. Verify the Carbon Black Service Account
   • Has all Windows & SQL Server permissions required.
   • Does not contain the special characters listed here.
5. Fully re-enter the Service Account credentials in both App Control services and IIS Application Pools.
   • Verify the services and Application Pools remain running after re-entering the credentials.
   • If the Reporter Service fails to start due to 1053, follow the steps here.
6. Temporarily stop all security software (including the Agent if installed) and verify issue persists.
7. Validate all the 0kb .tmp files from the following directory have been successfully removed:

   C:\Users\<AppCserviceAccount>\AppData\Local\Temp\

8. Verify status of SQL Server:
   1. Open the shepherd.dsn file in a text editor (by default this is in the \Bit9\Parity Server\ directory)
   2. Verify the value for SERVER= examples:

      Local SQL Server (Single Tier):
      SERVER=.
      
      Remote SQL Server (Two Tier):
      SERVER=\\ServerName\Instance

      • If Two Tier, verify the SQL connection between the two Servers.
      • If SQL Instance was changed, the App Control Server software will need to be reinstalled with the new information.
   3. If using SQL Server Availability Groups (Always On) verify MultiSubnetFailover configuration.
   4. Verify Microsoft SQL Server Native Client is installed on the application server hosting the Console
   5. Verify SQL Services are fully operational.
   6. Run SQL Server Management Studio as the Carbon Black Service Account and connect to the SQL Server.
   7. Verify the App Control database (das) exists.
   8. Verify SQL Server is meeting the minimum Operating Environment Requirements.

 

If the issue persists, provide the following logs & details to Support:

1. Date/Time issue started occurring (did any change precede the start of it?)
2. A copy of the IIS Logs from the last several days as a compressed (zip) file.
3. Windows Event Viewer Logs
4. Enable Server High Debug Logs via SQL
   1. Restart the Server and Reporter services 
   2. Wait 5 minutes and capture logs.
5. SQL Database Logs (including CB Analysis Script results).