How to Collect an Strace for cb-enterprise

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to collect an strace on cb-enterprise for unexplained permissions issues during service startup. 

Environment

• Carbon Black EDR Server: All Versions

Resolution

1. Open a terminal session with the EDR server backend. 
2. On terminal one, run the following command to start the strace capture

   Standalone:
   strace -s 500 -I 1 -fr -o startup.strace /usr/share/cb/cbservice cb-enterprise start
   
   Cluster:
   strace -s 500 -I 1 -fr -o startup.strace /usr/share/cb/cbcluster start

3. Collect the startup.strace written in the current working directory for support review.