Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: What are the common sensor communication error messages? (HRESULT)

EDR: What are the common sensor communication error messages? (HRESULT)


  • EDR Sensor: All Versions (Formerly CB Response)
  • Microsoft Windows: All Supported Versions
  • Apple macOS: All Supported Versions
  • Linux: All Supported Versions


What are the common sensor connection error messages? (HRESULT)


  • Here are a list of common HRESULTs
    0x80070002?Win32Does not exist
    0x800700055Win32Access Denied
    0x800704c71223Win32The operation was canceled by the user
    0x8007274c10060Win32A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (Timeout)

    No Connection could be made because the target machine actively refused it

    (RST by Server)

    The request has timed out
    The URL specified a scheme other than "http:" or "https:"
    The server name cannot be resolved
    Connection to the server has failed


    The connection with the server has been reset or terminated, or an incompatible SSL protocol was encountered. 

    For example, WinHTTP version 5.1 does not support SSL2 unless the client specifically enables it.

    Proxy, SSL Inspection or 3rd party Application blocking communication request

    One or more errors were found in the Secure Sockets Layer (SSL) certificate sent by the server.
    0x80c8003c60CurlPeer Certificate cannot be authenticated with given CA certificates (Server SSL cert cannot be recognized)
    0x80C800033CurlCURLE_URL_MALFORMAT  – The URL was not properly formatted
    0x80c800066CurlCould not resolve hostname. (DNS translation)
    0x80c8001c28CurlTimeout was reached (TCP layer)
    0x80C8002335CurlSSL Connect Error. A problem with the SSL/TLS handshake
    0x80C8003C60CurlServer SSL Certificate not recognized
    0x80CB003D61CurlCURLE_BAD_CONTENT_ENCODING "Unrecognized transfer encoding"
    0x80C8005A90CurlCURLE_SSL_PINNEDPUBKEYNOTMATCH Failed to match the pinned key specified with CURLOPT_PINNEDPUBLICKEY.
    0x80190190400HTTPBad Request
    0x80190192402HTTPPayment Required
    Possible symptom of license expiration
    Access Denied
    0x80190198408HTTPRequest Timeout
    0x8019019D413HTTPPayload Too Large - The request is larger than the server is willing or able to process

    Internal Server Error
    Registration Failure

    0x801901F6502HTTPBad Gateway
    0x801901F7503HTTPService Unavailable. Used by the server to throttle sensors
    0x801901F8504HTTPGateway Timeout
    Server error response code indicates that the server, while acting as a gateway or proxy, cannot get a response in time
    0x80cc006e15001204Unknown Error. Usually Firewall, Proxy or SSL Inspection
  • To find the translation of a different HRESULT error. CB Response: How to Translate the CB Sensor Communication Error Code (HRESULT)

Additional Notes

  • HRESULTS are broken down into three fields. 
    • Severity: An error, warning, or information.
    • Facility: The class or errors
    • Error: The actual error code. The error code only makes sense when evaluated in the context of the appropriate facility
  • On Windows, Sensor communication errors can be found in C:\Windows\CarbonBlack\Diagnostics\SensorComms.txt after running "sc control carbonblack 201" in an administrative Command Prompt.
  • On macOS and Linux, Sensor communication errors can be found in: /var/lib/cb/sensor/sensor_comms.log
  • The sensor utilizes the Operating System to provide the error codes. 

Related Content

Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Creation Date: