Environment
- App Control Server: All Supported Versions
- EDR Sensor: All Supported Versions
Symptoms
Seeing Health Check Events in App Control Console related to EDR sensors not functioning
Carbon Black App Control Agent detected a problem: EDR healthcheck failed. Carbon Black Sensor (CarbonBlack) is not running.
Carbon Black App Control Agent detected a problem: Neither cbstream.sys or cbtdiflt.sys are loaded.
Cause
This happens when the agent detects an EDR sensor and the sensor isn't functioning normally
Resolution
- If the EDR sensor is supposed to be installed fix the issue stated in the event
- If the EDR sensor is not being used then it may need to be uninstalled via uninst.exe or have remnants of an old sensor removed
Additional Notes
The health check can be configured to be
ignored but fixing the actual cause of the event would be recommended
Related Content
