CB Response: Services fail to start after recovering from Server outage
book
Article ID: 287788
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- Services fail to start automatically or manually
- Response Server logs are missing from:
/var/log/cb/
Cause
Server only partially recovered, and caused minor corruption of the Response Server software.
Resolution
- Confirm CB Service User account and group is set appropriately within /etc/cb/cb.conf:
# Service user account and group
CbUser=cb
CbGroup=cb
- Confirm if a configuration backup is available for Response.
- If available, perform a configuration restore.
- If a snapshot is available, restore can be used to attempt a recovery.
- If no backup is available or a restore does not resolve the issue, a removal and re-installation of the CB Response Server will be needed.
Additional Information
Instructions on how to remove and install the CB Response Server software are available in the
CB Response Server/Cluster Guide.
Feedback
thumb_up
Yes
thumb_down
No