EDR: Sensor Module Does Not Load Device Or Resource Busy
book
Article ID: 291138
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
In the EDR console sensor health is 50 /100
Sensor Health reports Event Source not Connected
Environment
EDR Sensor: 7.0.3 or Greater
App Control Agent: 8.7.16 and Lower
Red Hat 7.9
Cause
In some cases the cbproxy module from Carbon Black App Control can interfer with the insertion of the cbsensor module
Resolution
This issue should no longer occur in Agent version 8.7.18 and above
The Workaround for when installing agent versions below 8.7.18 is
1. Stop the App Control daemon
2. Unload the App Control Modules
3. Unload cbsensor
4. run /etc/sysconfig/cbresponse.modules start
5. Start the App Control daemon
Additional Information
The App Control Agent installer may make changes to /etc/sysconfig/modules/cbresponse.modules to avoid this issue