Cb Response: Unable to Touch /tmp/.cb_tmp on Services Start/Stop/Status

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• When run cbcluster start/stop, or cb-enterprise start/stop, get the following message:

 

Unable to delete temporary directory '/tmp/.cb_tmp' as user 'carbonAdm' on host '<hostname>' with command '/bin/rmdir /tmp/.cb_tmp'. Reason: /bin/rmdir: failed to remove `/tmp/.cb_tmp': No such file or directory. 
Execution will continue, but you should consider manually removing this directory.

 

• When run cbcluster status, or cb-enterprise status, get the following message:

Move `/tmp/.cb_tmp': No such file or directory. 
Execution will continue, but you should consider manually removing this directory.

 

Environment

• Cb Response Server: All versions

Cause

A file from /var/cb/.erlang.cookie usually gets copied to the /tmp directory but wasn't able to.
 

Resolution

• Please check the permissions of this file on all nodes. It's usually in /var/cb, but might be in /app/cb. 

-rw-------. 1 cb cb 20 Feb 2 00:00 .erlang.cookie

• Cluster/cb-enterprise stop should be used, and confirm no hanging processes before starting again.