Duplicate Device Entries - Devices Going To the "Standard" Policy

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Audit and Remediation
• Carbon Black Cloud Prevention
• Carbon Black Cloud Workload

Issue/Introduction

Duplicate entries are seen for the same device in the console. Each with a different "Registered" Date/Time and a unique Device ID. Additionally these devices may go to the default "Standard" policy instead of the policy they were assigned at install. Confer.log will show the registration attempts after the corruption:

ERROR     DbSafeInitialize: failed to initialize C:\ProgramData\CarbonBlack\DataFiles\db_rep database: err[not an error]
WARNING   DbSafeInitialize: trying to recover
INFO      RepUtilRestoreSafeDbBackup: restored rep_db from safe backup
.....
INFO      CloudTask::OfflineInstall::RunTask: Offline Install detected and Cloud is now reachable - Attempting to register...
INFO      RepUtilRegisterAfterOfflineInstall: Beginning registration attempt..

Environment

• Carbon Black Cloud Sensor: 3.9.x - 4.0.x
• Microsoft Windows: All Supported Versions

Cause

Ungraceful / hard shutdowns causing corruption of the sensor files. During this corruption the registration and policy information is lost, so it re-registers and may change policy depending on the settings enabled in the org.

Resolution

Investigations are underway to make the sensor more robust during ungraceful shutdowns. This being tracked under CRE-18013 / DSEN-27717 / DSEN-27719