CB Response: Minion fails to start, other process using port 5000
search cancel

CB Response: Minion fails to start, other process using port 5000

book

Article ID: 289517

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • One or more minions fails to start when a cluster start command is issued
  • Service failing to start is `cb-coreservices`
  • /var/log/cb/coreservices/debug.log on Master shows connection to node fails
  • /var/log/cb/coreservices/startup.log on failing Minion shows connection over :: (IPv4 localhost) on port 5000 failed

Environment

  • CB Response: 6.x
  • Clustered environment

Cause

Port 5000 in use by another process

Resolution

  1. Stop Cluster services from Master (Cluster > steps 1, 2)
  2. Connect to minion and launch terminal
  3. Find ports being used by Process name and Process ID (PID)
    netstat -tulpn
  4. Get more information on Process using port 5000 from above
    ps aux|grep <ProcesName>
  5. Kill process using port 5000 by PID
    kill -9 <PID>
  6. Start Cluster services from Master (Cluster > step 3)

Additional Information

Work with administrator for 3rd-party application to change the port for that program away from port 5000 to avoid the need to do these steps each time