- EDR Sensor: All Versions (Formerly CB Response)
- Microsoft Windows: All Supported Versions
- Apple macOS: All Supported Versions
- Linux: All Supported Versions
What are the common sensor connection error messages? (HRESULT)
- Here are a list of common HRESULTs
|0x80070002||?||Win32||Does not exist|
|0x800704c7||1223||Win32||The operation was canceled by the user|
|0x8007274c||10060||Win32||A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (Timeout)|
No Connection could be made because the target machine actively refused it
(RST by Server)
The request has timed out
The URL specified a scheme other than "http:" or "https:"
The server name cannot be resolved
Connection to the server has failed
The connection with the server has been reset or terminated, or an incompatible SSL protocol was encountered.
For example, WinHTTP version 5.1 does not support SSL2 unless the client specifically enables it.
Proxy, SSL Inspection or 3rd party Application blocking communication request
One or more errors were found in the Secure Sockets Layer (SSL) certificate sent by the server.
|0x80c8003c||60||Curl||Peer Certificate cannot be authenticated with given CA certificates (Server SSL cert cannot be recognized)|
|0x80C80003||3||Curl||CURLE_URL_MALFORMAT – The URL was not properly formatted|
|0x80c80006||6||Curl||Could not resolve hostname. (DNS translation)|
|0x80c8001c||28||Curl||Timeout was reached (TCP layer)|
|0x80C80023||35||Curl||SSL Connect Error. A problem with the SSL/TLS handshake|
|0x80C8003C||60||Curl||Server SSL Certificate not recognized|
|0x80CB003D||61||Curl||CURLE_BAD_CONTENT_ENCODING "Unrecognized transfer encoding"|
|0x80C8005A||90||Curl||CURLE_SSL_PINNEDPUBKEYNOTMATCH Failed to match the pinned key specified with CURLOPT_PINNEDPUBLICKEY.|
Possible symptom of license expiration
|0x8019019D||413||HTTP||Payload Too Large - The request is larger than the server is willing or able to process|
Internal Server Error
|0x801901F7||503||HTTP||Service Unavailable. Used by the server to throttle sensors|
Server error response code indicates that the server, while acting as a gateway or proxy, cannot get a response in time
|0x80cc006e||15001||204||Unknown Error. Usually Firewall, Proxy or SSL Inspection|
- To find the translation of a different HRESULT error. CB Response: How to Translate the CB Sensor Communication Error Code (HRESULT)
- HRESULTS are broken down into three fields.
- Severity: An error, warning, or information.
- Facility: The class or errors
- Error: The actual error code. The error code only makes sense when evaluated in the context of the appropriate facility
- On Windows, Sensor communication errors can be found in C:\Windows\CarbonBlack\Diagnostics\SensorComms.txt after running "sc control carbonblack 201" in an administrative Command Prompt.
- On macOS and Linux, Sensor communication errors can be found in: /var/lib/cb/sensor/sensor_comms.log
- The sensor utilizes the Operating System to provide the error codes.