Environment
- VMware Carbon Black EDR Server: All Versions
Symptoms
One of the following messages are logged in /var/log/cb/job-runner/job-runner.log when a cron job fails to start:
- "Job watchlist_search was not run because cb-enterprise is stopped."
- "Job modulestore_purge was not run because cb-enterprise is stopped."
- "Job solr_optimize was not run because cb-enterprise is stopped."
Cause
This can occur when cb-enterprise is truly stopped or in the process of stopping. This can also occur in some cases even when running "service cb-enterprise status" or "systemctl status cb-enterprise" with root permissions and it returns all services in a RUNNING state.
Resolution
In one scenario, running an strace with the cb-supervisord status command logged a failed attempt to open the file /etc/profile.d/lang.sh due to a permissions issue:
open("/etc/profile.d/lang.sh", O_RDONLY) = -1 EACCES (Permission denied)
In this case, the directory permissions did not allow execution of the lang.sh and caused the service cb-supervisord status command to return nothing. This condition then caused the cron job to stop executing due. To correct this the directory permissions were modified to octal 755 with this command:
chmod 755 /etc/profile.d
Additional Notes
- There might be several other causes for the /sbin/service wrapper to not redirect to the /bin/systemctl command. Troubleshooting this is usually possible by prepending an strace command to the service you are trying to start, stop, or retrieve status information from. For example, this would trace the execution of a "service cb-supervisord status" command and send it to the file strace.txt:
sudo -u cb strace /sbin/service cb-supervisord status &> strace.txt