EDR: How to reset Mnesia for RabbitMQ

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Reset the RabbitMQ working directory after corruption.

Environment

• EDR Server: 5.x and Higher

Resolution

1. Check disk storage /var/cb/data and /var/log/cb. These directories need at least 50 mb for RabbitMQ to start:

•  In a clustered environment, complete the following on all nodes (starting with the primary server)

df -h /var/cb/data /var/log/cb

2. Stop the EDR services:
   1. For EDR version 7.4.0 and newer, refer to these instructions.  
   2. For EDR versions older than 7.4.0, refer to the user guide. 
3. Remove any hanging processes.

E.g: 

• ps -ef | grep cb

NOTE: cbdaemon and event-forwarder services should not affect the startup and shutdown of server services

• killall -KILL -u cb kills any processes owned by the cb user. A similar effect can be achieved by manually killing any pids returned with the above ps command

  4. Remove mnesia directory:

• In a clustered environment, complete the following on all nodes (starting with the primary server)

rm -rf /var/cb/data/rabbitmq/mnesia

  5. Start the EDR Services.