EDR: CB-Coreservices Not Starting: Can't connect to ('::', 5000)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• CB-Coreservices service fails to start.  Output in /var/log/messages:

Feb  2 11:04:24 edr-server cb-enterprise[346833]: Starting cb-coreservices:                                  [^[[31mFAILED^[[0m]

• Errors seen in /var/log/cb/coreservices/startup.log:

[2022-02-02 11:04:19 +0300] [348374] [INFO] Starting gunicorn 20.1.0
[2022-02-02 11:04:19 +0300] [348374] [ERROR] Retrying in 1 second.
[2022-02-02 11:04:20 +0300] [348374] [ERROR] Retrying in 1 second.
[2022-02-02 11:04:21 +0300] [348374] [ERROR] Retrying in 1 second.
[2022-02-02 11:04:22 +0300] [348374] [ERROR] Retrying in 1 second.
[2022-02-02 11:04:23 +0300] [348374] [ERROR] Retrying in 1 second.
[2022-02-02 11:04:24 +0300] [348374] [ERROR] Can't connect to ('::', 5000)

Environment

• EDR Server: All Supported Versions

Cause

• EDR Instance is not listening on IPV6 ('::', 5000).
• This is caused by the CoreServicesIP="[::]" parameter in the /etc/cb/cb.conf file and should most likely be: CoreServicesIP="0.0.0.0", depending on the EDR instance configuration.

Resolution

• Change the following parameter in the /etc/cb/cb.conf file:

CoreServicesIP="0.0.0.0"

• Restart instance or cluster services:

sudo systemctl restart cb-enterprise

sudo /usr/share/cb/cbcluster stop
sudo /usr/share/cb/cbcluster start