Troubleshooting Failed Agent Host Package or Rules Installation

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

To troubleshoot failures during the upload/install of a new Agent Host Package or Rules Installer

Environment

• App Control Console: All Supported Versions
• App Control Host Package Installer: All Supported Versions

Resolution

Initial Troubleshooting:

1. Install all certificates needed to validate the Agent Host Package or Rules installers.
2. Verify each of the following:
   
   • Server Antivirus Exclusions are added to all other security products on the server hosting the web console.
   • App Control Service Account has all required SQL permissions
   • There is enough free space on the application server.
   • Delete all of the Local App Data temporary files.
   • The system date/time is set to US format (e.g. MM/DD/YY)
3. Attempt to install the Agent Host Package or Rules locally.
4. If an Agent is installed on the application server
   • Temporarily disable Tamper Protection.
   • Completely stop the agent via CMD as Admin:

     • net stop parity
       fltmc unload paritydriver

   • Attempt the install again
5. Log in to the Console and navigate to Reports > Events.
   1. Change the Saved View to: Server Management.
   2. Adjust the Max Age accordingly.
   3. Review for any related Events/Failure Messages.
6. Log in to the Console and navigate to: https://<ServerAddress>/support.php > Scheduled Tasks
   1. Locate the Task: ProcessHostPackageInstaller
   2. Verify it shows as Enabled

If the issue persists:

1. Log in to the application server as the Carbon Black Service Account.
2. Start a Standard Procmon Capture.
3. Log in to the Console and navigate to https://<ServerAddress>/Support.php > Diagnostics and choose:
   • Snapshot Server Logs (to write current logs and start a new file)
   • Logging Duration: 30 Minutes
   • All Debug Levels: High
   • Click Start Logging
4. Replicate the issue by uploading the Agent Host Package Installer accordingly.
5. Navigate back to: https://<ServerAddress>/Support.php > Diagnostics > Stop Logging Now.
6. Complete the Procmon capture.
7. Navigate to the C:\Program Files (x86)\Bit9\Parity Server\Support\ directory and copy all files generated during the capture similar to:
   • ServerLog-TIMESTAMP.bt9 (there may be multiple similar timestamps, download all)
   • ReporterLog-TIMESTAMP.log
   • PHPErrors-TIMESTAMP.log
   • RulesInstaller-TIMESTAMP.log
   • HostPackageInstaller-TIMESTAMP.log
     • If an error was encountered, this may still be in C:\Users\<serviceaccount>\AppData\Local\Temp\
8. Zip the Procmon, Diagnostic Files and provide to Support.

Additional Information

For issues with Package Generation (or Policy Installer Generation) follow the troubleshooting steps here.