CB Response: Sensors Unable To Connect To CB Response Server
search cancel

CB Response: Sensors Unable To Connect To CB Response Server

book

Article ID: 290849

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Sensors unable to check-in, connect or upload data to CB Response server.
  • The following error is seen in /var/log/cb/sensorservices/startup.log: 
    error: [Errno 107] Transport endpoint is not connected.

Environment

  • CB Response Server: 6.5.2 and Higher

Cause

Rsyslog service is stuck and/or cannot reach the remote host used for custom forwarding.

Resolution

  1. Confirm rsyslog service is running:
    service rsyslog status
  2. Restart rsyslog service:
    service rsyslog restart
  3. Troubleshoot connectivity to remote host used for custom forwarding; start by disabling custom forwarding temporarily and see if sensors begin to connect.

Additional Information

Rsyslog is not a part of CB Response, however is heavily relied on by CB Response to function.