How to create a symbolic link for the /srv/bit9 directory on a Linux Agent endpoint

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Explains how to create a symbolic link for the /srv/bit9 directory on a Linux Agent endpoint to prevent the partition from running out of space

Environment

• App Control Linux Agent: All Supported Versions
• Linux: All Supported Versions

Resolution

This is a workaround to allow the relocation of the agents cache files by creating a SOFT symlink (symbolic link) to a different partition
This must be setup before the agent is installed. If the agent already exists, it will need to be uninstalled and reinstalled

1. Make sure that the physical location of the data directory to be used is loaded and available on boot (e.g. is mounted via /etc/fstab)
   1. Set aside at least 3GB - 5GB of space for the agent cache files
2. Create the Soft symlink for the bit9 folder with the following command:

ln -s /path/to/new/bit9 /srv

3. Install the App Control Linux agent
4. Verify symlink was successful:
   1. Run the following cmd to validate the "bit9" folder has a smaller folder size (double-digits at most):

ls -la /srv

2. Run the following cmd on the new symlink location to see the normal data structure typically found in /srv/bit9, including the agent cache files, which will be rebuilding:

ls -la <new location>

      5. Verify agent connects to console properly.

Additional Information

• The resolution listed above will cause the agent to reinitialize, because the symbolic link must be created before the Agent is installed.
• To uninstall agents that were install with this workaround, the additional rules from the PDF document will need to be disabled. Upgrades should NOT require disabling the rules.
• Make sure prelink is disabled as it can contribute to over-sized agent caches