Server Services Do Not Start Troubleshooting Guide

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• After stopping and then trying to start services a process may still fail.
• What to do to find out what is happening?

Environment

• EDR Server: All Supported
• Linux Server: All Supported

Resolution

1. Verify which service is failing to start by running one of the following commands on the server with a failing service
   • Check the /var/log/cb/supervisord/supervisord.log to see what services started or exited

     cat /var/log/cb/supervisord/supervisord.log

   • Check each individual service status

     /usr/share/cb/cbservice cb-enterprise status

   • Check /var/log/messages for cb-

     grep cb- /var/log/messages

2. Compare the above logs with the service startup order to determine which one was the failure point
3. Once it's clear which one was the one that failed review it's startup.log to determine why it failed
   • Each service has a startup log which gets written to in the following location /var/log/cb/<service_name_relevant>
   • For above example cb-pgsql logs to /var/log/cb/pqsql/startup.log so using cat or tail on it like

     cat /var/log/cb/pgsql/startup.log

4. Search the knowledge base here on any potential error messages

Additional Information

• On a stand-alone EDR server the services can be started individually if there is a timeout but do not start services individually on a cluster as the services need to be in sync between all nodes in the cluster
• Server logs can be gathered following these steps