EDR: After OS patching, Solr, Datastore and Datagrid are Unable to Start

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Solr, Datastore and Datagrid services will not start using the cb-enterprise script or manually.
• OS patches, to include java, were upgraded after EDR was upgraded, however the rpmnew files were not merged properly.
• Datagrid debug log contains:

2023-12-15 00:00:27,544 - [WARN] - from com.carbonblack.datagrid.persist.DbPool in main
Error testing SQL connection: java.sql.SQLException: Cannot create PoolableConnectionFactory (Something unusual has occurred to cause the driver to fail. Please report this exception.)

• OpenJDK directory had configs with 0 size.  

find /usr/lib/jvm -size 0

• OpenJDK directory had several rpmnew files.

find /usr/lib/jvm -name "*rpmnew"

 

Environment

• EDR Server:  7.8.0

Cause

Perhaps during the OS patches, the rpmnew files were not merged correctly leading the config files to 0 and several rpmnew files in /usr/lib/jvm.  

Resolution

1. In /usr/lib/jvm, make backup files of any non-zero configuration file.
2. Manually copy the .rpmnew files to their original file names.  
3. Start the services.

Additional Information

• Additional checks during troubleshooting:
  • Check the firewall rules and confirm Postgres port 5002 can be reached on the Primary/Standalone server.  Confirm selinux permissions are correct.

/usr/share/cb/cbcheck firewall -a 
/usr/share/cb/cbcheck selinux -a

• Confirm networking configurations have not been altered.
• Look for rpmnew files that need to be rectified. 

find /. -name "*rpmnew"