IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

Cb Response: Sensors no longer checking into minions but are still checking into master

Cb Response: Sensors no longer checking into minions but are still checking into master

Environment

  • CB Response Server: 6.x and Higher
  • Recent changes were made to disable IPv6 in CB Response

Symptoms

  • Overall backlog has increased
  • Sensors will check into the master server, but communication to the minions fails

Cause

There is a misconfiguration for sensor communication in cb.conf

Resolution

  1. Review EDR: Nginx will not start with IPv6 Error
  2. Verify SensorServicesIP is set to 0.0.0.0 and not 127.0.0.1
  3. If disabling IPv6 was not necessary to start Response services, comment out "LiveResposeIP", "WebsocketBindHost", and "SensorServicesIP" in cb.conf
  4. Restart services - EDR: How to Restart Server Services

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎02-05-2019
Views:
329
Contributors