CB Response: Sensors Unable To Connect To CB Response Server
book
Article ID: 290849
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Sensors unable to check-in, connect or upload data to CB Response server.
The following error is seen in /var/log/cb/sensorservices/startup.log:
error: [Errno 107] Transport endpoint is not connected.
Environment
CB Response Server: 6.5.2 and Higher
Cause
Rsyslog service is stuck and/or cannot reach the remote host used for custom forwarding.
Resolution
Confirm rsyslog service is running:
service rsyslog status
Restart rsyslog service:
service rsyslog restart
Troubleshoot connectivity to remote host used for custom forwarding; start by disabling custom forwarding temporarily and see if sensors begin to connect.
Additional Information
Rsyslog is not a part of CB Response, however is heavily relied on by CB Response to function.