CB-Coreservices Not Starting: Can't connect to ('::', 5000)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• CB-Coreservices service fails to start.  Output in /var/log/messages:

Feb  2 11:04:24 edr-server cb-enterprise[346833]: Starting cb-coreservices:                                  [^[[31mFAILED^[[0m]

• Errors seen in /var/log/cb/coreservices/startup.log:

[2022-02-02 11:04:19 +0300] [348374] [INFO] Starting gunicorn 20.1.0
[2022-02-02 11:04:19 +0300] [348374] [ERROR] Retrying in 1 second.
[2022-02-02 11:04:20 +0300] [348374] [ERROR] Retrying in 1 second.
[2022-02-02 11:04:21 +0300] [348374] [ERROR] Retrying in 1 second.
[2022-02-02 11:04:22 +0300] [348374] [ERROR] Retrying in 1 second.
[2022-02-02 11:04:23 +0300] [348374] [ERROR] Retrying in 1 second.
[2022-02-02 11:04:24 +0300] [348374] [ERROR] Can't connect to ('::', 5000)

Environment

• EDR Server: All Supported Versions

Cause

• EDR Instance is not listening on IPV6 ('::', 5000).
• This is caused by the CoreServicesIP="[::]" parameter in the /etc/cb/cb.conf file and should most likely be: CoreServicesIP="0.0.0.0", depending on the EDR instance configuration.

Resolution

• Change the following parameter in the /etc/cb/cb.conf file:

CoreServicesIP="0.0.0.0"

• Restart instance or cluster services:

sudo systemctl restart cb-enterprise

sudo /usr/share/cb/cbcluster stop
sudo /usr/share/cb/cbcluster start

 

Additional Information

• Coreservices is not the only service that would be affected by the IPV6 default configuration of the EDR cluster. NGINX and others can have the same issue and can be resolved by following the steps in the Nginx will not start with IPv6 Error - "Address family not supported by protocol" KB article.