EDR: all watchlist's show as queued

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• No watchlist hits
• No feed hits
• On the watchlist page, each watchlist shows as "queued" and never executes. 

Environment

• EDR (formerly CB Response) Server: 7.x

Cause

This is due to not reconciling the new cron template file (/etc/cb/cron/cb.cron.template.rpmnew) with the current version (/etc/cb/cron/cb.cron.template) after an upgrade.

Resolution

1. Backup the original template file:

cp /etc/cb/cron/cb.cron.template /etc/cb/cron/cb.cron.template.bak

2.  Rename the rpmnew file.  

/etc/cb/cron/cb.cron.template.rpmnew /etc/cb/cron/cb.cron.template

3. Reconcile by manually copying any custom cron jobs from cb.cron.template.bak to cb.cron.template.
4. For cluster environments, repeat steps 1 and 2. If standalone, continue with step(s).
5. Restart services

Additional Information

This occurs because the python interpreter path changed in version 7.x. The cb.cron.template.rpmnew file contains the correct location, while the old 6.x version does not.