Common sensor communication error messages (HRESULT)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

A list of some common EDR sensor connection error messages. (HRESULT)

Environment

• EDR Sensor: All Versions
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions
• Linux: All Supported Versions

Resolution

• Here are a list of common HRESULTs

  HRESULT	Code	Facility	Translation
  0x80070002	?	Win32	Does not exist
  0x80070005	5	Win32	Access Denied
  0x800704c7	1223	Win32	The operation was canceled by the user
  0x8007274c	10060	Win32	A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (Timeout)
  0x8007274d	10061	Win32	No Connection could be made because the target machine actively refused it (RST by Server)
  0x80072EE2	12002	WinHTTP	ERROR_INTERNET_TIMEOUT. The request has timed out
  0x80072EE6	12006	WinHTTP	ERROR_WINHTTP_UNRECOGNIZED_SCHEME The URL specified a scheme other than "http:" or "https:"
  0x80072EE7	12007	WinHTTP	ERROR_WINHTTP_NAME_NOT_RESOLVED The server name cannot be resolved
  0x80072EFD	12029	WinHTTP	ERROR_WINHTTP_CANNOT_CONNECT Connection to the server has failed
  0x80072EFE	12030	WinHTTP	ERROR_WINHTTP_CONNECTION_ERROR The connection with the server has been reset or terminated, or an incompatible SSL protocol was encountered.  For example, WinHTTP version 5.1 does not support SSL2 unless the client specifically enables it. Proxy, SSL Inspection or 3rd party Application blocking communication request
  0x80072F8F	12175	WinHTTP	ERROR_WINHTTP_SECURE_FAILURE One or more errors were found in the Secure Sockets Layer (SSL) certificate sent by the server.
  0x80c8003c	60	Curl	Peer Certificate cannot be authenticated with given CA certificates (Server SSL cert cannot be recognized)
  0x80C80003	3	Curl	CURLE_URL_MALFORMAT  – The URL was not properly formatted
  0x80c80006	6	Curl	Could not resolve hostname. (DNS translation)
  0x80c8001c	28	Curl	Timeout was reached (TCP layer)
  0x80C80023	35	Curl	SSL Connect Error. A problem with the SSL/TLS handshake
  0x80C8003C	60	Curl	Server SSL Certificate not recognized
  0x80CB003D	61	Curl	CURLE_BAD_CONTENT_ENCODING "Unrecognized transfer encoding"
  0x80C8005A	90	Curl	CURLE_SSL_PINNEDPUBKEYNOTMATCH Failed to match the pinned key specified with CURLOPT_PINNEDPUBLICKEY.
  0x80190190	400	HTTP	Bad Request
  0x80190192	402	HTTP	Payment Required Possible symptom of license expiration
  0x80190193	403	HTTP	Forbidden Access Denied
  0x80190198	408	HTTP	Request Timeout
  0x8019019D	413	HTTP	Payload Too Large - The request is larger than the server is willing or able to process
  0x801901F4	500	HTTP	Internal Server Error Registration Failure
  0x801901F6	502	HTTP	Bad Gateway
  0x801901F7	503	HTTP	Service Unavailable. Used by the server to throttle sensors
  0x801901F8	504	HTTP	Gateway Timeout Server error response code indicates that the server, while acting as a gateway or proxy, cannot get a response in time
  0x80cc006e	15001	204	Unknown Error. Usually Firewall, Proxy or SSL Inspection

• To find the translation of a different HRESULT error: Translate the EDR Communication Error Codes (HRESULT)

Additional Information

• HRESULTS are broken down into three fields. 
  • Severity: An error, warning, or information.
  • Facility: The class or errors
  • Error: The actual error code. The error code only makes sense when evaluated in the context of the appropriate facility
• On Windows, Sensor communication errors can be found in C:\Windows\CarbonBlack\Diagnostics\SensorComms.txt after running "sc control carbonblack 201" in an administrative Command Prompt.
• On macOS and Linux, Sensor communication errors can be found in: /var/lib/cb/sensor/sensor_comms.log
• The sensor utilizes the Operating System to provide the error codes.