EDR: How to reset Mnesia for RabbitMQ

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Reset the RabbitMQ working directory after corruption.

Environment

• EDR Server: 5.x and Higher

Resolution

1. Check disk storage /var/cb/data and /var/log/cb. These directories need at least 50 mb for RabbitMQ to start:

•  In a clustered environment, complete the following on all nodes (starting with the primary server)

df -h /var/cb/data /var/log/cb

2. Stop the EDR services:
   1. For EDR version 7.4.0 and newer, refer to these instructions.  
   2. For EDR versions older than 7.4.0, refer to the user guide. 
3. Remove any hanging processes: Remove Hanging Processes
4. Remove mnesia directory:

• In a clustered environment, complete the following on all nodes (starting with the primary server)

rm -rf /var/cb/data/rabbitmq/mnesia

4. Start the EDR Services.