cb-rabbitmq appears to start with an "OK" (but actually has errors at startup time)
cb-datastore fails to start
This error was found in /var/log/cb/datastore/debug.log
2020-09-08 21:11:04,208 - [ERROR] - from com.carbonblack.cbfs.http.listeners.WebAppContextListener in main
Initialization error, exiting
java.net.ConnectException: Connection refused (Connection refused)
This error occurs in /var/log/cb/rabbitmq/startup.out:
2020-09-08 21:47:56,080 - [ERROR] - from com.carbonblack.cbfs.http.listeners.WebAppContextListener in main
Initialization error, exiting
com.rabbitmq.client.AlreadyClosedException: channel is already closed due to channel error; protocol method: #method<channel.close>(reply-code=404, reply-text=NOT_FOUND - no exchange 'api.events' in vhost '/', class-id=50, method-id=20)
Environment
EDR Server: 7.x
EDR Sensor: all versions
Linux: All versions
Cause
SELinux was enabled
Resolution
Disable SELinux
sudo setenforce 0
Clear temporary rabbitmq mnesia data using this solution - https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-reset-Mnesia-for-RabbitMQ/ta-p/64848