EDR: Sensor Module Does Not Load Device Or Resource Busy

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• In the EDR console sensor health is 50 /100
• Sensor Health reports Event Source not Connected

Environment

• EDR Sensor: 7.0.3 or Greater
• App Control Agent: 8.7.16 and Lower
• Red Hat 7.9 

Cause

In some cases the cbproxy module from Carbon Black App Control can interfer with the insertion of the cbsensor module

Resolution

• This issue should no longer occur in Agent version 8.7.18 and above
• The Workaround for when installing agent versions below 8.7.18 is

  1. Stop the App Control daemon
  2. Unload the App Control Modules
  3. Unload cbsensor 
  4. run /etc/sysconfig/cbresponse.modules start
  5. Start the App Control daemon

Additional Information

The App Control Agent installer may make changes to /etc/sysconfig/modules/cbresponse.modules to avoid this issue