VMware Carbon Black Cloud Linux Sensor Error out during Update process

Issue

The user initiates a sensor update process from the PSC console for several Linux endpoints. During the process an endpoint ends in failure and it is automatically left in Bypass mode. When trying to remove the bypass mode for the endpoint it reverts back to bypass.

The Sensor diagnostics show errors similar to:

[2021-09-22 13:42:57.244492] [1711:1721] [E] CbRpmPackageTool : GetPackageSignatureKey : RPM command pipe failed (Bad file descriptor)
[2021-09-22 13:42:57.244499] [1711:1721] [E] SwUpgradeTool : VerifyCodeSignature : Could not find keyId of package file; error=4
[2021-09-22 13:42:57.244504] [1711:1721] [E] SwUpgradeTool : FailUpgrade : Software Upgrade process failed (error)
[2021-09-22 13:42:57.244614] [1711:1721] [I] SwUpgradeState : SetState : Persisted SwUpgradeState Failed

Environment

VMware Carbon Black Enterprise EDR

VMware Carbon Black Standard EDR

Resolution

The endpoint will remain in bypass as the services are not able to recover from the update process. To recover the endpoint please manually stop and start the services manually by using the commands:

Stop:
sudo systemctl stop cbagentd

Start:
sudo systemctl start cbagentd

Once the services are restored and the endpoint removed from bypass mode, manually update the endpoint to the new sensor version.

Cause

Sensor services are unable to recover from the update failure as part of the process is to set the sensor on bypass mode until the sensor update is completed. Once the sensor updates fail the services are not restored and the bypass mode is unable to change back to previous status.