Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Uninstall of OS X sensor using sensoruninst.sh hangs and never completes

Uninstall of OS X sensor using sensoruninst.sh hangs and never completes

Version
Carbon Black v5.X


Issue

Uninstall of OS X sensor using /Application/CarbonBlack/sensoruninst.sh command does not complete. 

 

Symptoms

Review of  /var/log/cblog.log shows the following with no further output:

Stopping The CarbonBlack Daemon...

Daemon stopped.

KEXT found at /Library/Extensions/CbOsxSensorProcmon.kext, unloading...

 

Cause

Some versions of OS X and sensor can encounter problems unloading the kernel extension which prevents uninstall/upgrade process from completing.

Solution

Manual removal of OS X kernel extension and sensor files is necessary if the Carbon Black kernel extension will not unload through standard commands. 

1. Move the following files/directories to a temp location on the OS X endpoint.  These files may be deleted after step 3.

/Application/CarbonBlack

/Library/Extensions/CbOsxSensorNetmon.kext

/Library/Extensions/CbOsxSensorProcmon.kext

/Library/LaunchDaemon/com.carbonblack.daemon.plist

/var/lib/cb

2. Reboot the OS X endpoint

3. Carbon Black Response Sensor will be cleanly uninstalled.  You may run the Sensor installer again if needed.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎07-13-2016
Views:
791
Contributors