CB Response: Sensors Unable To Connect To CB Response Server

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensors unable to check-in, connect or upload data to CB Response server.
• The following error is seen in /var/log/cb/sensorservices/startup.log: 

  error: [Errno 107] Transport endpoint is not connected.

Environment

• CB Response Server: 6.5.2 and Higher

Cause

Rsyslog service is stuck and/or cannot reach the remote host used for custom forwarding.

Resolution

1. Confirm rsyslog service is running:

   service rsyslog status

2. Restart rsyslog service:

   service rsyslog restart

3. Troubleshoot connectivity to remote host used for custom forwarding; start by disabling custom forwarding temporarily and see if sensors begin to connect.

Additional Information

Rsyslog is not a part of CB Response, however is heavily relied on by CB Response to function.