CB Response: Cannot cleanly stop and restart Linux Sensor with Cylance also installed
book
Article ID: 288178
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Newly installed Cb Response Sensor 6.x on Linux does not start and stop cleanly with Cylance also installed.
These errors can be observed in standard output:
systemctl status cbdaemon.service --full
cbdaemon.service - LSB: Bit9 Sensor
Loaded: loaded (/etc/rc.d/init.d/cbdaemon; bad; vendor preset: disabled)
Active: active (exited) since Tue 2018-10-23 12:42:05 EDT; 2min 40s ago
Docs: man:systemd-sysv-generator(8)
Process: 16009 ExecStart=/etc/rc.d/init.d/cbdaemon start (code=exited, status=0/SUCCESS)
Oct 23 12:42:05 cmsisplx10 systemd[1]: Starting LSB: Bit9 Sensor...
Oct 23 12:42:05 cmsisplx10 cbdaemon[16009]: Starting cbdaemon: WARNING: Logging before InitGoogleLogging() is written to STDERR
Oct 23 12:42:05 cmsisplx10 cbdaemon[16009]: W1023 12:42:05.853521 16021 main.cpp:138] Found pid file from previous run that is not associated with a running process. Check for daemon cores.
Oct 23 12:42:05 cmsisplx10 cbdaemon[16009]: [ OK ]
Oct 23 12:42:05 cmsisplx10 systemd[1]: Started LSB: Bit9 Sensor.
Environment
CB Response Sensor: 6.x and higher
Linux: All supported platforms
Cause
Cylance is interfering with Cb Response sensor accessing its own files and directories.
Resolution
Add these three file specifications to the Cylance exclusion list: