EDR: Error "sensor_id is not present in table "sensor_registrations""

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• All sensors appear offline on Sensor page
• Process events and binaries are up to date
• Error in /var/log/cb/sensorservice/sensorservice.log:

<err> cb.sensor.backlog_cache - 
... 
util.raise_from_cause(sqlalchemy_exception, exc_info) 
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/sqlalchemy/util/compat.py", line 383, in raise_from_cause 
reraise(type(exception), exception, tb=exc_tb, cause=cause) 
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/sqlalchemy/engine/base.py", line 1224, in _execute_context 
cursor, statement, parameters, context 
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/sqlalchemy/dialects/postgresql/psycopg2.py", line 725, in do_executemany 
cursor.executemany(statement, parameters) 
IntegrityError: (psycopg2.IntegrityError) insert or update on table "sensor_queued_data_stats" violates foreign key constraint "sensor_queued_data_stats_sensor_id_fkey" 
DETAIL: Key (sensor_id)=(XXXX) is not present in table "sensor_registrations".

Environment

• EDR (formerly CB Response) Server: All versions

Cause

The problem is that the sensor IDs that removed from postgres are still cached in redis, so those sensors can still check in with their existing IDs. Other operations, however, that require the id to be present in the sensor_registrations table are failing and causing the exceptions above. 

Resolution

Perform a restart to force Redis to resync with Postgres.

Additional Information

Please don't perform any delete operation against Postgres without consulting Support.