CB Response: Out of License Message from Sensors

[#1]

Environment

• Carbon Black Response Sensor: All Versions
• Linux: All Supported Versions
• macOS: All Supported Versions

Symptoms

Out of License health score messages 

Cause

Unresponsive CB EDR server might not return a response to the sensor during a license validity check 

Resolution

• Restart the sensor service to clear the message.
  • This can be done via the console under the Actions panel
  • By script using this command "sudo service cbdaemon restart" and method of deployment choice
  • Via CbAPI. Download: Out_Of_License_Restart.py

    # provides dryrun before restarting
    Out_Of_License_Restart.py -d
    # restart sensors
    Out_Of_License_Restart.py 

    • This script is a modified version of the restart_sensors.py and made specifically for this error message. 
• CB-31080 is in progress to check sensor side

Additional Notes

• License is enforced on the server side. This specific message does not affect the sensors sending up data with a score of -25. Other healthchecks along with it will have a higher score, at that time more investigation would be needed. 
• The health score does not update after getting a successful validity check, restarting sensor services clears the healtcheck

Related Content

https://github.com/carbonblack/cbapi-python
https://cbapi.readthedocs.io/en/latest/
https://developer.carbonblack.com/guide/enterprise-response/getting-started-with-the-cbapi/