Troubleshooting Agent Install or Upgrade Issues

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

To troubleshoot Agent installation and upgrade failures

Environment

• App Control Agent: All Supported Versions
• App Control Console: All Supported Versions

Resolution

Initial Troubleshooting Steps

1. Verify that all other security tools have all antivirus exclusions for the Agent.
2. For Windows Endpoints, confirm:
   1. There are no leftover agent registry keys present from earlier deployments.
   2. MSI transformations during install or upgrade are not being used.
3. If upgrading via SCCM (command line or similar) verify the correct commands & procedures are used:
   
   • Methods To Install an App Control Agent
   • Methods To Upgrade The App Control Agent
4. If upgrading via the Console:
   1. Verify the Resource Download Location is accessible to the endpoints over Port 443.
   2. Navigate to Assets > Computers
   3. Add the Column > Upgrade Status and review accordingly:
      • Upgrade waiting:
        • Upgrade request is pending and not sent to Agents yet
        • If large numbers are stuck in this status, review Agent Upgrades Pushed by Console Are Stalled
      • Upgrade scheduled:
        1. Upgrade request is sent to Agent.
        2. Upgrade download is attempted by the endpoint via the Resource Download Location.
        3. After successful download, installation is attempted on the endpoint and Upgrade Errors are returned.
      • Upgrade blocked: Agent CL is bellow the minimum CL for upgrade
      • Reboot required: A system reboot is required to complete the install
   4. Add the Column > Upgrade Error.
      • Use the error message or error code to search for the relevant article
      • Example: Postponed until system updates are completed

Reviewing the Agent Install or Upgrade logs (Windows)

1. Obtain the Agent Install or Upgrade Logs from the most recent failed attempt.
2. Search for the very first instance of the string "Value 3" in the MSI log. Windows Installer uses value 3 to indicate a fatal error, example:

   <Cb CustomAction> [05-09-2019 21:00:20:854] Unable to download config file Error[WinHttpQueryHeaders StatusCode[000001F7]] 
   CustomAction b9CA_A_ConfigRetrieval returned actual error code 1603 (note this may not be 100% accurate if translation happened inside sandbox) 
   Action ended 21:00:20: b9CA_A_ConfigRetrieval. Return value 3. 
   Action ended 21:00:20: INSTALL. Return value 3.

   • The error/failure message that stopped the upgrade is listed within several lines above value 3.
   • Use the error messages found to search for the relevant article.
   • Example: Download Failures Due To WinHttpQueryHeaders StatusCode[000001F7]

 

If further troubleshooting is needed collect the following information before creating a support case:

• Operating System version and build/kernel being used.
• Agent versions being installed or upgrading from/to.
• Method that is being used to install/upgrade the Agent (Console, SCCM, GPO, etc)
• The command line being used to install/upgrade (if any)
• Copy of the Agent Install or Upgrade Logs obtained from most recent failures.
• Historical Agent Logs (for upgrades only)