Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud Linux Sensor: Zombie processes created by sensor

Carbon Black Cloud Linux Sensor: Zombie processes created by sensor

Environment

  • Carbon Black Cloud Linux Sensor:2.11.2.545096 - 2.13.2
  • Linux: All Supported Versions

Symptoms

  • Zombie processes created by the cbagentd
    • ps -ef | grep -i ECStateEngine root 2125 1864 0 Dec15 ? 00:00:00 [ECStateEngine] <defunct> root 3682 1864 0 09:19 ? 00:00:00 [ECStateEngine] <defunct> root 7999 1864 0 Dec19 ? 00:00:00 [ECStateEngine] <defunct> root 8056 1864 0 Dec19 ? 00:00:00 [ECStateEngine] <defunct>

Cause

VMware engineering team is aware of the issue an is investigating the cause. 

Resolution

The article will be updated when the fix is implemented and corresponding sensor release version is announced. 

Additional Notes

To check and verify for zombie processes are present, run the command below in terminal
ps -ef | grep defunct
Output should look similar to 
ps -ef | grep defunct
root 489 30703 0 Nov15 ? 00:00:00 [ECStateEngine] <defunct>
root 526 30703 0 Nov15 ? 00:00:00 [ECStateEngine] <defunct>
root 535 30703 0 Nov15 ? 00:00:00 [ECStateEngine] <defunct>
root 565 30703 0 Nov15 ? 00:00:00 [ECStateEngine] <defunct>
root 1129 30486 0 Nov07 ? 00:00:00 [nsrexecd] <defunct>

Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎01-26-2022
Views:
700
Contributors