EDR: Sensorcomms.log shows HRESULT error 0x80c80006 for eventlog upload attempts
search cancel

EDR: Sensorcomms.log shows HRESULT error 0x80c80006 for eventlog upload attempts

book

Article ID: 289073

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Sensor.log has the following errors:
id[AF04] 2018-12-19 09:31:29 (w): Unable to properly synch with server HrError[0x80C80006] 
Tid[AF04] 2018-12-19 09:31:41 (w): HTTP transaction failed with CURL code 6 HrError[0x80C80006] 
Tid[AF04] 2018-12-19 09:31:41 (e): ReserveEventLog failed HTTPCode[0] HrError[0x80C80006] 
Tid[AF04] 2018-12-19 09:31:41 (w): Unable to push event log 'eventlog_490491421.52429.log.zip' HrError[0x80C80006] 
Tid[AF04] 2018-12-19 09:31:41 (w): Unable to properly synch with server HrError[0x80C80006] 
Tid[14C8] 2018-12-19 09:31:41 (e): Unable to parse DNS response HrError[0x80070057]
  • Sensorcomms.log has the following error:
<DATE> | https://<SERVERNAME>.my.cbcloud.io:443/data/eventlog/reserve/198724 | 0x80c80006 | 6 | 10719 | 0 | 0 | 500 | 0

 

Environment

  • Cb EDR Sensor: All Supported Versions

Cause

DNS name resolution is failing to resolve the hostname

Resolution

Fix the DNS resolution for the SERVERNAME the sensor is trying to communicate with

Additional Information

  • Proxies and Firewalls must allow unfiltered data between the sensor and server
  • Cb.exe can show the meaning behind the error code:
c:\Windows\CarbonBlack>cb.exe -e 0x80C80006 
0x80C80006: Facility[CURL] Code[0006] Severity[1] Couldn't resolve host name.