Linux Agent Becomes Disconnected During Attempted Policy Changes

Products

• Carbon Black App Control

Issue/Introduction

• Linux Agent 8.8.4 shows Disconnected in the Console after attempting a Policy move that involves a change in Enforcement Level (such as Restoring Normal Enforcement from Local Approval).
• Using b9cli --status shows Connected with the Session claiming Active, but with a CommStatus of HTTP Error 104, example:

  Client Information
    Connection:    Connected
    CommStatus:    HTTP Error 104
    Session:       Active

Environment

• Linux Agent 8.8.4

Cause

This issue is actively being investigated by Engineering (CRE-22931).

Resolution

• Restarting the Agent will restore communication with the Server and the Policy change will complete.
• The following temporary Agent Config can be created to help prevent encountering this situation:
  • Name: TMP - Disable Event XML (CRE-22931)
  • Host ID: 0
  • Value:

    event_xml_mask=0

  • Platform: Linux
  • Status: Enabled
  • Create For: All Current and Future Policies