EDR: Sensor Module Does Not Load Device Or Resource Busy
search cancel

EDR: Sensor Module Does Not Load Device Or Resource Busy

book

Article ID: 291138

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • In the EDR console sensor health is 50 /100
  • Sensor Health reports Event Source not Connected

Environment

  • EDR Sensor: 7.0.3 or Greater
  • App Control Agent: 8.7.16 and Lower
  • Red Hat 7.9 

Cause

In some cases the cbproxy module from Carbon Black App Control can interfer with the insertion of the cbsensor module

Resolution

  • This issue should no longer occur in Agent version 8.7.18 and above
  • The Workaround for when installing agent versions below 8.7.18 is
    1. Stop the App Control daemon
    2. Unload the App Control Modules
    3. Unload cbsensor 
    4. run /etc/sysconfig/cbresponse.modules start
    5. Start the App Control daemon

Additional Information

The App Control Agent installer may make changes to /etc/sysconfig/modules/cbresponse.modules to avoid this issue