EDR: yara-connector fails to start

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When attempting to start the Yara Connector, the following error occurs:

error while loading shared libraries: libz.so.1

Environment

• EDR Server: All Versions
• CB Yara Connector: All Versions

Cause

The /tmp mount point on the Linux OS is mounted with "noexec" flag.

Resolution

Mount the /tmp mount point with the "exec" flag. VMWare Carbon Black Support does not assist with this as it is a system administration task.

Additional Information

The command to check if your /tmp mount point is configured with "noexec" flag is:

grep '\s/tmp' /etc/fstab