cbagentd not checking in to cloud after reboot.

Products

• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Audit and Remediation
• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Container
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Managed Detection (formerly Cb Threatsight)
• Carbon Black Cloud Managed Detection and Response
• Carbon Black Cloud Managed Threat Hunting
• Carbon Black Cloud Prevention
• Carbon Black Cloud Workload

Issue/Introduction

After the server is rebooted, the Carbon Black agent isn't checking into the CBC or uploading events.
Manually restarting the agent using "systemctl restart cbagentd" will bring the agent back online until the next reboot.

Environment

 Sensor 2.15 through 2.16.1 versions.

Cause

Defective behavior that happens when docker engine socket doesn't respond to cbagentd queries upon the system startup, resulting in cbagent's thread responsible for checking to the cloud to fail, which in its turn renders the server offline with no check in to the Carbon Black Cloud backend.

Resolution

This defective behavior will be fixed in future sensor releases 2.17.0
For the time being, customers can follow the following workaround:

configure cbagentd.service to start after docker.service: e.g. in /etc/systemd/system/cbagentd.service:

[Unit]
Description=Carbon Black Predictive Security Cloud Endpoint Agent.
# After=network.target
After=network.target docker.service