EDR: Server won't start, stops at cb-datastore.
search cancel

EDR: Server won't start, stops at cb-datastore.

book

Article ID: 286275

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  1. cb-rabbitmq appears to start with an "OK"  (but actually has errors at startup time)
  2. cb-datastore fails to start
  3. This error was found in /var/log/cb/datastore/debug.log 
    2020-09-08 21:11:04,208 - [ERROR] - from com.carbonblack.cbfs.http.listeners.WebAppContextListener in main
    Initialization error, exiting
    java.net.ConnectException: Connection refused (Connection refused)
  4. This error occurs in /var/log/cb/rabbitmq/startup.out: 
    2020-09-08 21:47:56,080 - [ERROR] - from com.carbonblack.cbfs.http.listeners.WebAppContextListener in main 
    Initialization error, exiting
    com.rabbitmq.client.AlreadyClosedException: channel is already closed due to channel error; protocol method: #method<channel.close>(reply-code=404, reply-text=NOT_FOUND - no exchange 'api.events' in vhost '/', class-id=50, method-id=20)

Environment

  • EDR Server: 7.x 
  • EDR Sensor: all versions
  • Linux: All versions

Cause

SELinux was enabled

Resolution

  1. Disable SELinux
    • sudo setenforce 0
  2. Clear temporary rabbitmq mnesia data using this solution - https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-reset-Mnesia-for-RabbitMQ/ta-p/64848
  3. Restart services - https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Restart-Server-Services/ta-p/41294