EDR: cb-enterprise fails to start with error "OSError: [Errno 40] Too many levels of symbolic links"
book
Article ID: 289161
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
CB-Enterprise service fails to start on cluster with (FAILURE) event on nodes
Journalctl shows an error like:
Apr 21 22:51:02 x.x.x.x.x. cb-enterprise[28825]: OSError: [Errno 40] Too many levels of symbolic links: '/var/cb/data/solr/cbevents/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928/cbevents_2022_03_05_1928'
Environment
EDR Server: All Versions
Linux OS: All Supported Versions
Symbolic links in /var/cb/data/solr/cbevents directory
Cause
Symbolic links were created and nested inside of other symbolic links causing a recursive chain that leads to an OS failure message.
Resolution
Identify the cbevents-* core that has the recursive symbolic link from the 'journalctl' logs.
SSH into the affected minion node
Change directory into the affected solr cbevents core
cd /var/cb/data/solr/cbevents/<eventcorewithsymboliclink>
Remove the symbolic link inside the event core folder.