CB Response: Server stopping nightly

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Services stop running around the same time each night
• /var/log/cb/supervisord/supervisord.log shows a SIGKILL for cb-enterprise
• Services may attempt to start up later, but fail

Environment

• CB Response Server: All Versions

Cause

• There is a job outside of Response killing services. This can include processes such as updates which are running on an exact cron schedule or backups which can be an approximate time each night. 

Resolution

• Services must be stopped properly before the job is run and then started back up once complete - https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-restart-server-services/ta-p/41294

Additional Information

• CB Response will never automatically start up after shutdown except when the entire server is started up. If /var/log/cb/supervisord shows services starting up at a time when an admin did not start services, this is a sign of a job outside of Response stopping services.
• Killing Cb Response services improperly can result in data corruption
• Cron jobs can be found under /etc/cron.d