Environment
- EDR Sensor: All Versions (Formerly CB Response)
- Microsoft Windows: All Supported Versions
- Apple macOS: All Supported Versions
- Linux: All Supported Versions
Question
What are the common sensor connection error messages? (HRESULT)
Answer
- Here are a list of common HRESULTs
| HRESULT | Code | Facility | Translation |
| 0x80070002 | ? | Win32 | Does not exist |
| 0x80070005 | 5 | Win32 | Access Denied |
| 0x800704c7 | 1223 | Win32 | The operation was canceled by the user |
| 0x8007274c | 10060 | Win32 | A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond. (Timeout) |
| 0x8007274d | 10061 | Win32 |
No Connection could be made because the target machine actively refused it
(RST by Server)
|
| 0x80072EE2 | 12002 | WinHTTP | ERROR_INTERNET_TIMEOUT.
The request has timed out |
| 0x80072EE6 | 12006 | WinHTTP | ERROR_WINHTTP_UNRECOGNIZED_SCHEME
The URL specified a scheme other than "http:" or "https:" |
| 0x80072EE7 | 12007 | WinHTTP | ERROR_WINHTTP_NAME_NOT_RESOLVED
The server name cannot be resolved |
| 0x80072EFD | 12029 | WinHTTP | ERROR_WINHTTP_CANNOT_CONNECT
Connection to the server has failed |
| 0x80072EFE | 12030 | WinHTTP |
ERROR_WINHTTP_CONNECTION_ERROR
The connection with the server has been reset or terminated, or an incompatible SSL protocol was encountered.
For example, WinHTTP version 5.1 does not support SSL2 unless the client specifically enables it.
Proxy, SSL Inspection or 3rd party Application blocking communication request
|
| 0x80072F8F | 12175 | WinHTTP | ERROR_WINHTTP_SECURE_FAILURE
One or more errors were found in the Secure Sockets Layer (SSL) certificate sent by the server. |
| 0x80c8003c | 60 | Curl | Peer Certificate cannot be authenticated with given CA certificates (Server SSL cert cannot be recognized) |
| 0x80C80003 | 3 | Curl | CURLE_URL_MALFORMAT – The URL was not properly formatted |
| 0x80c80006 | 6 | Curl | Could not resolve hostname. (DNS translation) |
| 0x80c8001c | 28 | Curl | Timeout was reached (TCP layer) |
| 0x80C80023 | 35 | Curl | SSL Connect Error. A problem with the SSL/TLS handshake |
| 0x80C8003C | 60 | Curl | Server SSL Certificate not recognized |
| 0x80CB003D | 61 | Curl | CURLE_BAD_CONTENT_ENCODING "Unrecognized transfer encoding" |
| 0x80C8005A | 90 | Curl | CURLE_SSL_PINNEDPUBKEYNOTMATCH Failed to match the pinned key specified with CURLOPT_PINNEDPUBLICKEY. |
| 0x80190190 | 400 | HTTP | Bad Request |
| 0x80190192 | 402 | HTTP | Payment Required
Possible symptom of license expiration |
| 0x80190193 | 403 | HTTP | Forbidden
Access Denied |
| 0x80190198 | 408 | HTTP | Request Timeout |
| 0x8019019D | 413 | HTTP | Payload Too Large - The request is larger than the server is willing or able to process |
| 0x801901F4 | 500 | HTTP |
Internal Server Error
Registration Failure
|
| 0x801901F6 | 502 | HTTP | Bad Gateway |
| 0x801901F7 | 503 | HTTP | Service Unavailable. Used by the server to throttle sensors |
| 0x801901F8 | 504 | HTTP | Gateway Timeout
Server error response code indicates that the server, while acting as a gateway or proxy, cannot get a response in time |
| 0x80cc006e | 15001 | 204 | Unknown Error. Usually Firewall, Proxy or SSL Inspection |
- To find the translation of a different HRESULT error. CB Response: How to Translate the CB Sensor Communication Error Code (HRESULT)
Additional Notes
- HRESULTS are broken down into three fields.
- Severity: An error, warning, or information.
- Facility: The class or errors
- Error: The actual error code. The error code only makes sense when evaluated in the context of the appropriate facility
- On Windows, Sensor communication errors can be found in C:\Windows\CarbonBlack\Diagnostics\SensorComms.txt after running "sc control carbonblack 201" in an administrative Command Prompt.
- On macOS and Linux, Sensor communication errors can be found in: /var/lib/cb/sensor/sensor_comms.log
- The sensor utilizes the Operating System to provide the error codes.
Related Content
