Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Response 6.1 upgrade: Startup halts after "Waiting for cb-sensorservices to initialize..."

Response 6.1 upgrade: Startup halts after "Waiting for cb-sensorservices to initialize..."

Version

Cb Response 6.x and later versions

Issue

On startup after upgrade, SensorServices component indicates an OK startup, but then shows "Waiting for cb-sensorservices to initialize..." and then startup halts.

Symptoms

Review of the /var/log/cb/sensorservices/startup.log will show messages indicating the following:

[ERROR] Can't connect to ('::', 6500)

[ERROR] Can't connect to ('::', 6501)

Cause

This behavior can occur if IPv6 is disabled on the Response server or cluster.  It can also occur if ports 6500/6501 are blocked (these are ports used by the SensorServices component).

Solution

Check if IPv6 is disabled in the environment.  If it is disabled, add the following line to /etc/cb/cb.conf (parameter is not currently present) on master/minions and do a clean shutdown and restart:

SensorServicesIP=0.0.0.0

If IPv6 is not disabled, check if port 6500 and 6501 are open and accessible in IPtables on standalone Response server (or both master and minions in a cluster):

/usr/share/cb/cbcheck iptables -l

If the above command lists entries that need to be added, execute the following to apply the IPtables change (on master and minion in a cluster)

/usr/share/cb/cbcheck iptables -a

and then do a clean shutdown and startup:

in cluster:

/usr/share/cb/cbcluster stop (on master)

ps -ef |grep cb (on master/minions)

kill <pid> (for any remaining processes owned by cb, you may leave any integration processes running)

/usr/share/cb/cbcluster start (on master)

in standalone server:

service cb-enterprise stop

ps -ef |grep cb

kill <pid> (for any remaining processes owned by cb, you may leave any integration processes running)

service cb-enterprise start

If neither of these options resolves the issue, please check if the server admin to confirm 6500 6501 ports are not being blocked by another firewall or policy.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎05-23-2017
Views:
826
Contributors