CB Response: Services fail to start after recovering from Server outage
search cancel

CB Response: Services fail to start after recovering from Server outage

book

Article ID: 287788

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Services fail to start automatically or manually
  • Response Server logs are missing from:
    /var/log/cb/

Environment

  • CB Response Server: 6.X

Cause

Server only partially recovered, and caused minor corruption of the Response Server software.

Resolution

  1. Confirm CB Service User account and group is set appropriately within /etc/cb/cb.conf:
    # Service user account and group
    CbUser=cb
    CbGroup=cb
  2. Confirm if a configuration backup is available for Response.
    1. If available, perform a configuration restore.
    2. If a snapshot is available, restore can be used to attempt a recovery.
  3. If no backup is available or a restore does not resolve the issue, a removal and re-installation of the CB Response Server will be needed.

Additional Information

Instructions on how to remove and install the CB Response Server software are available in the CB Response Server/Cluster Guide.