CB Response: Server / Cluster will not restart showing error: "Unlinking stale socket /var/run/cb/cb-supervisor.sock"
book
Article ID: 288216
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Standard out of the startup dialog looks something like this:
Unable to restart cluster services
Node[0 ] Starting cb-supervisord: [ OK ]
Node[3] Starting cb-supervisord:
Node[3] Unlinking stale socket /var/run/cb/cb-supervisor.sock
Running "/usr/share/cb/cbdiag" on the bad node hangs, resulting in a ps -ef command showing one more of this unexpected process:
rpm -q --queryformat=%{VERSION} cb-enterprise
Environment
CB Response Server: All versions
CB Response Sensor: All versions
Linux OS: All Supported Vversions
Cause
The Linux rpm database is corrupt.
Resolution
1. Delete the rpm_db files:
rm -f /var/lib/rpm/__db*
2. Recreate the rpm _db files:
rpm --rebuilddb
Additional Information
There are a number of factors that can lead to the RPM database corruption, such as incomplete previous transactions, installation of certain third-party software, removing specific packages, and many others.