CB Response: Cannot cleanly stop and restart Linux Sensor with Cylance also installed

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Newly installed Cb Response Sensor 6.x on Linux does not start and stop cleanly with Cylance also installed.
• These errors can be observed in standard output: 

  systemctl status cbdaemon.service --full 
   cbdaemon.service - LSB: Bit9 Sensor 
  Loaded: loaded (/etc/rc.d/init.d/cbdaemon; bad; vendor preset: disabled) 
  Active: active (exited) since Tue 2018-10-23 12:42:05 EDT; 2min 40s ago 
  Docs: man:systemd-sysv-generator(8) 
  Process: 16009 ExecStart=/etc/rc.d/init.d/cbdaemon start (code=exited, status=0/SUCCESS) 
  
  Oct 23 12:42:05 cmsisplx10 systemd[1]: Starting LSB: Bit9 Sensor... 
  Oct 23 12:42:05 cmsisplx10 cbdaemon[16009]: Starting cbdaemon: WARNING: Logging before InitGoogleLogging() is written to STDERR 
  Oct 23 12:42:05 cmsisplx10 cbdaemon[16009]: W1023 12:42:05.853521 16021 main.cpp:138] Found pid file from previous run that is not associated with a running process. Check for daemon cores. 
  Oct 23 12:42:05 cmsisplx10 cbdaemon[16009]: [ OK ] 
  Oct 23 12:42:05 cmsisplx10 systemd[1]: Started LSB: Bit9 Sensor.

Environment

• CB Response Sensor: 6.x and higher
• Linux: All supported platforms

Cause

• Cylance is interfering with Cb Response sensor accessing its own files and directories.

Resolution

Add these three file specifications to the Cylance exclusion list:

• /etc/init.d/cbdaemon
• /etc/rc*/*cbdaemon
• /usr/sbin/cbdaemon