Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Sensor Module Does Not Load Device Or Resource Busy

EDR: Sensor Module Does Not Load Device Or Resource Busy

Environment

  • EDR Sensor: 7.0.3 or Greater
  • App Control Agent: 8.7.16 and Lower
  • Red Hat 7.9 

Symptoms

  • In the EDR console sensor health is 50 /100
  • Sensor Health reports Event Source not Connected

Cause

In some cases the cbproxy module from Carbon Black App Control can interfer with the insertion of the cbsensor module

Resolution

  • This issue should no longer occur in Agent version 8.7.18 and above
  • The Workaround for when installing agent versions below 8.7.18 is
    1. Stop the App Control daemon
    2. Unload the App Control Modules
    3. Unload cbsensor 
    4. run /etc/sysconfig/cbresponse.modules start
    5. Start the App Control daemon

Additional Notes

The App Control Agent installer may make changes to /etc/sysconfig/modules/cbresponse.modules to avoid this issue
 

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎10-11-2023
Views:
140
Contributors