Carbon Black Cloud Sensor: Linux Endpoint Checks In but Fails to Send Data to the Backend

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• The Linux sensor successfully checks into the Carbon Black Cloud backend but does not send telemetry data. 
• Sensor appears online and not inside bypass. 
• No events or other telemetry is received by the backend
• The /var/opt/carbonblack/psc/log/blades/<BUILD>/threat_hunter_log.txt shows errors similar to:

[W] PolicyHandler : EnableBladesAsConfigured : Blade[E51C4A7E-2D41-4F57-99BC-6AA907CA3B40] is not registered, ignoring request to Enable it
[I] PolicyHandler : NotifyBladesNewPolicyIsAvailable : Successfully enabled blades based on policy data.

• The /var/opt/carbonblack/psc/log/log.txt file may show:

[E] Error in Updating Quarantine state.
[I] BladePlugin : FindBladeSlot : No registered blade found with id[40E797FD-4322-4D33-8E8C-EF697F4C2323]
[W] BladePlugin : AnyBladeErrors : Blade directory (/opt/carbonblack/psc/blades/40E797FD-4322-4D33-8E8C-EF697F4C2323) does not exist
[W] PolicyHandler : EnableBladesAsConfigured : Blade[40E797FD-4322-4D33-8E8C-EF697F4C2323] is not registered, ignoring request to Enable it

 

Environment

• Carbon Black Cloud Linux Sensor: 2.13 - 2.14
• Linux OS
• Manual installation or upgrade method

Cause

• Root cause is a known issue.
• This issue is triggered when the Sensor software is improperly installed or upgraded from any directory other than /var/opt/carbonblack/psc/pkgs/upgrade_staging

Resolution

To fix an endpoint that already shows this issue:

1. Uninstall the sensor
2. Manually re-install it using the exact steps indicated in the Linux Sensor User Guide.  
3. Ensure that the installation package is extracted to the /var/opt/carbonblack/psc/pkgs/upgrade_staging directory

To prevent future problems when manually upgrading or installing the Sensor:

1. Follow all instructions exactly in the Linux Sensor User Guide.
2. Extract the installation package to /var/opt/carbonblack/psc/pkgs/upgrade_staging

Additional Information

• Upgrading a sensor via the Carbon Black Cloud web interface will not cause this error. 
• This issue will be fixed in a future version of the Linux Sensor.