Version
Carbon Black v5.X
Issue
Uninstall of OS X sensor using /Application/CarbonBlack/sensoruninst.sh command does not complete.
Symptoms
Review of /var/log/cblog.log shows the following with no further output:
Stopping The CarbonBlack Daemon...
Daemon stopped.
KEXT found at /Library/Extensions/CbOsxSensorProcmon.kext, unloading...
Cause
Some versions of OS X and sensor can encounter problems unloading the kernel extension which prevents uninstall/upgrade process from completing.
Solution
Manual removal of OS X kernel extension and sensor files is necessary if the Carbon Black kernel extension will not unload through standard commands.
1. Move the following files/directories to a temp location on the OS X endpoint. These files may be deleted after step 3.
/Application/CarbonBlack
/Library/Extensions/CbOsxSensorNetmon.kext
/Library/Extensions/CbOsxSensorProcmon.kext
/Library/LaunchDaemon/com.carbonblack.daemon.plist
/var/lib/cb
2. Reboot the OS X endpoint
3. Carbon Black Response Sensor will be cleanly uninstalled. You may run the Sensor installer again if needed.
