CB Response: Services fail to start after recovering from Server outage

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Services fail to start automatically or manually
• Response Server logs are missing from:

  /var/log/cb/

Environment

• CB Response Server: 6.X

Cause

Server only partially recovered, and caused minor corruption of the Response Server software.

Resolution

1. Confirm CB Service User account and group is set appropriately within /etc/cb/cb.conf:

   # Service user account and group
   CbUser=cb
   CbGroup=cb

2. Confirm if a configuration backup is available for Response.
   1. If available, perform a configuration restore.
   2. If a snapshot is available, restore can be used to attempt a recovery.
3. If no backup is available or a restore does not resolve the issue, a removal and re-installation of the CB Response Server will be needed.

Additional Information

Instructions on how to remove and install the CB Response Server software are available in the CB Response Server/Cluster Guide.