The user initiates a sensor update process from the PSC console for several Linux endpoints. During the process an endpoint ends in failure and it is automatically left in Bypass mode. When trying to remove the bypass mode for the endpoint it reverts back to bypass.
The Sensor diagnostics show errors similar to:
[2021-09-22 13:42:57.244492] [1711:1721] [E] CbRpmPackageTool : GetPackageSignatureKey : RPM command pipe failed (Bad file descriptor)
[2021-09-22 13:42:57.244499] [1711:1721] [E] SwUpgradeTool : VerifyCodeSignature : Could not find keyId of package file; error=4
[2021-09-22 13:42:57.244504] [1711:1721] [E] SwUpgradeTool : FailUpgrade : Software Upgrade process failed (error)
[2021-09-22 13:42:57.244614] [1711:1721] [I] SwUpgradeState : SetState : Persisted SwUpgradeState Failed
VMware Carbon Black Enterprise EDR
VMware Carbon Black Standard EDR
The endpoint will remain in bypass as the services are not able to recover from the update process. To recover the endpoint please manually stop and start the services manually by using the commands:
sudo systemctl stop cbagentd
sudo systemctl start cbagentd
Once the services are restored and the endpoint removed from bypass mode, manually update the endpoint to the new sensor version.
Sensor services are unable to recover from the update failure as part of the process is to set the sensor on bypass mode until the sensor update is completed. Once the sensor updates fail the services are not restored and the bypass mode is unable to change back to previous status.
Please sign in to leave a comment.