EDR: cbcluster fails to start due to .erlang.cookie error

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• cbcluster start results in Exec failure (1)
• /var/cb/.erlang.cookie eacess errors are present in rabbitmq logs

Environment

• EDR Server: Version 6.x and Higher (formerly CB Response)

Cause

• cb-rabbitmq utilizes .erlang.cookie to verify nodes at startup and it has become unusable

Resolution

1. Delete /var/cb/.erlang.cookie if it exists
2. Make sure home directory of user cb is correct in /etc/passwd
3. Restart services

Additional Information

If cb-enterprise continues to fail on nodes of the cluster, confirm the permissions on the mnesia directory of the affected node(s) are the same as on nodes where cb-enterprise started successfully.