CB Response: "INI file doesn't exist" Error on Linux Sensor
search cancel

CB Response: "INI file doesn't exist" Error on Linux Sensor

book

Article ID: 289936

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Linux sensor installed but not reporting to the server.
  • Sensor log shows the following error:
E0808 16:00:37.815650 27699 configmgr.cpp:173] INI file doesn't exist at /var/lib/cb/sensorsettings.ini 
E0808 16:00:37.815996 27699 configmgr.cpp:182] Error reading Settings INI file

Environment

  • CB Response Sensor: All versions
  • Linux: All versions

Cause

/var/lib/cb/sensorsettings.ini is critical for the sensor the function.  It needs to be included in the installer directory.

Resolution

  • Don't use rpm command to install the sensor. 
  • "To install sensors on Linux endpoints: 
    1.In the navigation bar of the CB Response console, click Sensors to display the Sensors page. 
    2.In the Groups panel, select the sensor group for which you want to install the sensor package. 
    3.From the Download Sensor Installer drop-down list, select Linux Standalone RPM. The sensor package file is downloaded to your system.NoteTo install sensors on Linux systems, you must be a root user or have “sudoer” permissions and run the installer with “sudo”. 
    4.In the operating system, do the following: 
    a.Copy the <install package name>.tar.gz sensor installation package to the Linux endpoint. 
    b.Untar the <install package name>.tar.gz file to a temporary folder. Do not skip this step. 
    For example, at a command prompt and from the directory where the file is installed, run this command: 
    tar -zxvf <install file name>.tar.gz 
    c.From the extracted .tar.gz file, run the .sh file and then follow the installation prompts. 
    This installs the Linux sensor using the configuration provided in the sensorsettings.ini file. 
    After this process is complete, the Linux sensor is installed and running. The Sensors page shows the sensor as registered and checking into the CB Response server."