EDR: cb-enterprise fails to start with error "OSError: [Errno 40] Too many levels of symbolic links"
search cancel

EDR: cb-enterprise fails to start with error "OSError: [Errno 40] Too many levels of symbolic links"

book

Article ID: 289161

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • CB-Enterprise service fails to start on cluster with (FAILURE) event on nodes
  • Journalctl shows an error like: 
    • Apr 21 22:51:02 x.x.x.x.x. cb-enterprise[28825]: OSError: [Errno 40] Too many levels of symbolic links: '/var/cb/data/solr/cbevents/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928'

       

Environment

  • EDR Server: All Versions
  • Linux OS: All Supported Versions
  • Symbolic links in /var/cb/data/solr/cbevents directory

Cause

Symbolic links were created and nested inside of other symbolic links causing a recursive chain that leads to an OS failure message.

Resolution

  1. Identify the cbevents-* core that has the recursive symbolic link from the 'journalctl' logs.
  2. SSH into the affected minion node
  3. Change directory into the affected solr cbevents core
cd /var/cb/data/solr/cbevents/<eventcorewithsymboliclink>
  1. Remove the symbolic link inside the event core folder.
rm -rf <symboliclink>
  1. Restart cluster services
Powered by Wolken Software