EDR: Server Services Do Not Start Troubleshooting Guide

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

After stopping and then trying to start cb-enterprise the process may still fail. Where can go to find out what happening?  

Environment

• EDR Server: All Supported
• Linux Server: All Supported

Resolution

1. Verify the status of each of the services by running the following command

#/usr/share/cb/./cbservice cb-enterprise status

      The results of the above command should show if the service is running or stopped

2. If a service shows as stopped then proceed to review the startup log

      Each service has a startup log that gets written to in the following location /var/log/cb/<service_name_relevant> 

For Example: 
    cb-pgsql logs to /var/log/cb/pqsql/startup.log

      The log naming convention for each service is not the same, but they will have "startup" in the name

  3. Another technique to help troubleshoot which service is failing is to tail the supervisord log

For Example: 
     #tail -f /var/log/cb/supervisord/supervisord.log

      This should be done from a separate console instance than the one used to stop and start the services

Additional Information

For a list of Server Services and their starting order see here