EDR: The cb-stats service is stuck in STARTING status

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• /var/log/cb/supervisord/supervisord.log:

2020-07-22 14:45:41,268 INFO spawned: 'cb-stats' with pid 66726
2020-07-22 14:45:42,271 INFO success: cb-stats entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2020-07-22 14:45:43,093 INFO exited: cb-stats (exit status 1; not expected)

• /var/log/cb/cli/cli.log:

2020-07-23 14:59:20,203 ERROR [cb.maintenance.cbstats.main]   Nothing to do. Please, verify the command-line options that were used

Environment

• EDR (Formerly Carbon Black Response) Server: 6.x - 7.x

Cause

It could be one of two possibilities:

1. The cbstats.conf.template was not copied to /etc/cb/cbstats.conf
2. The /etc/cb/cbstats.conf file has a comma at the end

Resolution

1. Fix the /etc/cb/cbstats.conf file:

• If file exists, remove the comma from the end of /etc/cb/cbstats.conf file
• If no file exists, run below command:

  cp /usr/share/cb/setup/cbstats.conf.template /etc/cb/cbstats.conf

2. Start the cb-stats service

service cb-stats restart

 

Additional Information

The cbstats monitoring application tool needs to be enabled for the cb-stats service to exist