CB Response: Minion fails to start, other process using port 5000

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• One or more minions fails to start when a cluster start command is issued
• Service failing to start is `cb-coreservices`
• /var/log/cb/coreservices/debug.log on Master shows connection to node fails
• /var/log/cb/coreservices/startup.log on failing Minion shows connection over :: (IPv4 localhost) on port 5000 failed

Environment

• CB Response: 6.x
• Clustered environment

Cause

Port 5000 in use by another process

Resolution

1. Stop Cluster services from Master (Cluster > steps 1, 2)
2. Connect to minion and launch terminal
3. Find ports being used by Process name and Process ID (PID)

   netstat -tulpn

4. Get more information on Process using port 5000 from above

   ps aux|grep <ProcesName>

5. Kill process using port 5000 by PID

   kill -9 <PID>

6. Start Cluster services from Master (Cluster > step 3)

Additional Information

Work with administrator for 3rd-party application to change the port for that program away from port 5000 to avoid the need to do these steps each time