EDR: sensor is non-functional if carbonblack.db file can't be decrypted
search cancel

EDR: sensor is non-functional if carbonblack.db file can't be decrypted

book

Article ID: 289640

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • OSX sensor stops reporting to the server.
  • Sensor log shows:
"E1017 12:48:47.310252 435830208 SensorDatabase.cpp:889] OpenEncryptDBHandle : could not access DB post encryption: file is encrypted or is not a database Result[26]
E1017 12:48:47.310557 435830208 SensorDatabase.cpp:896] OpenEncryptDBHandle : could not reopen sqlite db: unable to open database file Result[14]
E1017 12:48:47.310600 435830208 SensorDatabase.cpp:79] Start: SensorDatabase could not open db file[/var/lib/cb/carbonblack.db
E1017 12:48:47.310628 435830208 sensor_service.cpp:400] on_startUnable to start the Sensor Database

Environment

EDR OSX sensor: 6.2.6 and 6.3

Cause

Bug CB-33318.

Resolution

  • This issue will be fixed on a future version.
  • Workaround:
1. Make sure AV exclusions are in place
2. Make sure installing sensor with the root account and enable full disk access.
3. Remove the carbonblack.db from the /var/lib/cb directory
4. Restart the sensor