How to Restart the VMware CB EDR Sensor

Question

How do I manually restart the sensor service?

Environment

VMware Carbon Black EDR; Microsoft Windows, macOS, Linux sensors

Resolution

Windows

From an elevated command prompt, execute the following commands to stop sensor services:

net stop carbonblack (pre 7.2.0)

net stop carbonblackk (pre 7.2.0)

fltmc unload carbonblackk (For 7.2.0+)

From an elevated command prompt, execute the following commands to start sensor services:

net start carbonblack

net start carbonblackk

fltmc load carbonblackk 

(Optional) To force the sensor to immediately check into the server:

sc control carbonblack 200

macOS

To stop the sensor daemon:

launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist

To start the sensor daemon:

launchctl load /Library/LaunchDaemons/com.carbonblack.daemon.plist

(Optional) To force the sensor to check into the server:

sudo kill -s USR1 <pid of CbOsxSensorService>

(To find the pid execute the following: ps ax | grep Cb and look for the CbOsxSensorService entry)

Linux

To restart the sensor daemon:

sudo systemctl restart cbdaemon

To stop and start the sensor daemon:

sudo systemctl stop cbdaemon

sudo systemctl start cbdaemon

(Optional) To force the sensor to check into the server:

sudo kill -10 $(pidof cbdaemon)