EEDR: Linux sensor shows the status: error 'Bypass (Service Error)' after a sensor version upgrade attempt.

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Linux sensor shows the status:  error 'Bypass (Service Error)'  after a sensor version upgrade attempt.
• These errors appear in /var/opt/carbonblack/psc/log/blades/Threat_hunter_log.txt:

[2022-08-19 15:19:42.467538] [156146:156181] [I] KernelCollectorIf : GetDevNum : No Event Collector device found
[2022-08-19 15:19:42.478040] [156146:156181] [E] KernelCollectorIf : OpenDevice : OpenDevice: Failed to create/open device file

 

Environment

• EEDR Sensor: All versions
• CBC Console: All versions
• Linux: All versions

Cause

This MAY be due to some services being in a corrupt state due to some communication issue.
 

Resolution

To eliminate this possibility , and to potentially fix the problem. try rebooting the operating system. If the problem still exists after a reboot, contact CB Customer Support.