Linux Agent installed on the Carbon Black EDR Server prevents the cb-enterprise service from staring

Products

• Carbon Black App Control
• Carbon Black EDR

Issue/Introduction

After an App Control Linux Agent is installed on the same system as the Carbon Black EDR Server, the cb-enterprise service fails to start properly.
The following error is displayed when attempting to start the service:

Starting cb-enterprise (via systemctl): Job for cb-enterprise.service failed because a timeout was exceeded. See "systemctl status cb-enterprise.service" and "journalctl -xe" for details. [FAILED]

Environment

• App Control Linux Agent: All Supported Versions
• EDR Server: All Supported Versions

 

Cause

The App Control agent causes a delay while analyzing file activity during the cb-enterprise startup process, triggering a timeout.

Resolution

1. Navigate to: https://AppcServer/agent_config.php > Add Agent Config:

   • Property Name: File Exclusions for EDR Server
     
     Value: 
     
     kernelFileOpExclusions=/var/cb/data/*:259967,/usr/share/cb/virtualenv/*:259967
     
     Platform: Linux
     
     Status: Enabled
     
     Create for: Select only the policy of the EDR Server systems
     
     Save and Exit

2. Wait until the agent is Up to Date, then attempt to start the EDR server again