CB Response: CB Taxii Script is Locked and Not Running

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• CB Taxii is not running.
• The file var/log/cb/integrations/cbtaxii/startup.log shows the error:

  Only one instance can run at once. Script is locked with /var/run/cb/cbtaxii.py.pid (pid: 1912)

Environment

• CB Response Server: Version 6.1.2 and Higher
• CB Taxii Threat Feed: Version 1.5 and Higher

Cause

The CB Taxii connector is protected from running multiple instances at once.

Resolution

1. Wait 10 minutes to see if the connector is no longer running.
2. If the process is still running:
   1. Find the CB Taxii process ID:

      ps -ef | grep cb

   2. Kill the process:

      kill -9 <pid_here>

   3. Verify the process is no longer running:

      ps -ef | grep cb

3. Remove the process ID file:

   rm /var/run/cb/cbtaxii.py.pid

4. Remove the lock file if needed.
5. Confirm that the integration is able to run:

   /usr/share/cb/integrations/cbtaxii/cbtaxii -c /etc/cb/integrations/cbtaxii/cbtaxii.conf

6. Verify that the CB Taxii service starts within the startup log:

   tail /var/log/cb/integrations/cbtaxii/startup.log