Services Failing to Start After Recovering from a Server Outage

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Services fail to start automatically or manually
• EDR Server logs are missing from:

  /var/log/cb/

Environment

• Carbon Black EDR: All Versions

Cause

Server only partially recovered, and caused minor corruption the EDR files. 

Resolution

1. Confirm cb Service User account and group is set appropriately within /etc/cb/cb.conf:

   # Service user account and group
   CbUser=cb
   CbGroup=cb

2. Confirm if a configuration backup is available for Response.
   1. If available, perform a configuration restore.
   2. If a snapshot is available, restore can be used to attempt a recovery.
3. If no backup is available or a restore does not resolve the issue, a fresh installation will be required.