Cb Response Linux Sensor 6.1.4 Release Notes

[#1]

The Cb Response Linux Sensor 6.1.4 Release Notes document provides information for users upgrading from previous versions as well as users new to the product. It includes the following sections:

• Corrective Content – Describes issues resolved by this release as well as more general improvements in performance or behavior.
• Known Issues and Limitations – Describes known issues or anomalies in this version.
• Contacting Technical Support – Describes ways to contact Carbon Black Technical Support and what information to have ready.

Hint: To scroll smoothly through the PDF on this page, change the viewing option from Single Pages to Continuous.

[triordan]

Updated description of  [CB-18382]. If you downloaded a previous version, please replace it with Version 3.

[jeffml]

The updated release notes document now states: Kernel panics associated with the RHEL/CentOS 3.10.0-693.21.1.el7.x86_64 and 2.6.32- 696.20.1.el6.x86_64 kernel updates have been eliminated. [CB-18382]

But the original impact document: [CbR and CbP] Security Update for RHEL/CentOS Impacting Cb Response and Cb Protection Customers states that the problematic kernels are: 3.10.0-693.21.1 or 2.6.32-696.23.1

[triordan]

Please see the actual text in the release notes for the specific kernel information. Thanks.

[jeffml]

Sorry I must not have been clear.  The quote is from the actual text in the updated release notes and differs from the original impact document (20.1 versus 23.1)

[triordan]

Thanks for keeping us on point here. It is indeed version 2.6.32-696.23.1. The document has been updated.

[jtw]

Uninstalled the previous version (6.1.3) with /opt/cbsensor/sensoruninstall.sh. So ended up with a lot of offline sensors in the gui. Therefor enabled VDI in the sensor group settings, to prevent having a lot of new sensors when i reinstalled. But this did only work for centos/rhel 6.8 and 6.9 and not for centos/rhel 7.3. Would be neat if it would work on 7.x as well . 

[triordan]

Version 4 includes additional known issues.

[pprasai]

Memory usage in the cbdaemon may increase due to the activity of some long-lived processes. A workaround is to restart the long-lived process or cbdaemon. [CB-16064]

• Some of the tracking data in the kernel is using more memory than expected. This is most noticeable on systems with many long-lived processes. [CB-18105]

How do we determine its a "long-lived processes"? Just wanted to understand the criteria on when to restart the cbdaemon.

[karl]

Instructions on how to update to this sensor version are available in the accouncement here: [Cb Response] Announcing General Availability of 6.1.4 and 5.2.15 Linux Sensors

[Cb Response] Announcing General Availability of 6.1.4 and 5.2.15 Linux Sensors