CB Response: Redis fails to start after upgrade to 6.4

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Upgrade fails to start services starting at redis

  • Starting cb-supervisord: [ OK ] 
    Stopping cb-supervisord: [ OK ] 
    Unable to start service: cb-redis 
    cb-enterprise auto-upgrade failure (exit code 1):

• /var/log/messages shows a segfault due to Cylance

  • redis-server: segfault at 0 ip 0000 sp 0000 error 4 in cymemdeflinux_x64.so

• No information is logged in redis logs

Environment

• CB Response Server: 6.4
• Cylance Installed

Cause

Cylance is blocking redis from starting

Resolution

• To start services up
  1. Stop Cylance
  2. Start Response
• As a permanent solution Cylance will need to stop blocking Redis
  • Disable Memory Protection in Cylance
  • Add Redis to exclusions in Cylance

Additional Information

• If the upgrade had not completed, run /usr/share/cb/cbupgrade after disabling Cylance. This will also start services up once complete
• Cylance service may be named cylancesvc or cyprotect on the server