Carbon Black Cloud 3.5.1.19 Sensor Install Error

[Phil_James]

I'm getting an error on Catalina & Big Sur installs for CBC sensor 3.5.1.19.

Line 870: echo ${run_install_log} >> ${LOG}

What does ambiguous redirect mean?

Anyone else having any issues? I've started support with CBC also.

[colordean]

Same issue here calling the policy as part of a DEPNotify workflow -- it seems like the installation is fine despite the error. I noticed that calling the policy a second time manually via the terminal doesn't throw any errors. Same behavior on 10.15.7 and 11.1 - Intel. Let us know if if you've found a solution!

[sgiesbrecht]

@Phil.James did you use the installation script that came with the package cbcloud_install_unattended.sh? I still have some issues with the install but your script looks a little different from they supplied

[colordean]

An update on my side:

Running the script as a separate component in the policy meant it failed on the first attempt, worked on the second (even though in either case the actual installation appeared fine.

I decided to wrap the script and .pkg together as its own .pkg and call the cbcloud_install_unattended.sh as part of a post-install script in the pkg and that seems to run fine.

[alexjdale]

I saw this too. It's just an error with their logging output that doesn't affect the install.

I use their supplied script (hard-coding the options instead of passing them) as a Jamf script that runs after another script pulls the pkg file from Azure, and it works great. I used to repackage the whole thing but it's easier to make changes this way.

[Phil_James]

Sorry for the late response.

After going back in forth with CBC, I think all is well. The sensor does install properly, and they blame the error code on how the script is run, bash?

From CBC, "As mentioned in the case comments this error is sometimes seen if the unattended installer is not run with bash. Since the installation was successful we don't have to worry about the error at this time. For future installations please run the unattended installer explicitly through bash and that will eliminate this error code."

I'm still a little confused because the script starts with !/bin/bash so I would assume it is run with bash?

Anyways, I'm going to proceed with my Big Sur updates now.

Thanks,

[obi-k]

Glad I'm not the only one seeing this same error. We had numerous issues with version 3.4.4.51. With version 3.5.1.19, we see the same error in the log as above, but it does install, even though it shows as "failed" in Jamf.

We've talked to Carbon Black support about this, sending all the logs from Jamf and Console. Hopefully, a new update fixes this?

[sgiesbrecht]

@Phil.James how did it go with the changes? what did you get to stop the logging error?

[Phil_James]

Still getting the exit code 1 error. Just a log error? I've been escalated.. again :) I'll let you know what I find out

Their last response.... btw, I've given them logs 3 times. We're getting closer though.

Hi Phil,

Thank you for your patience. It appears to be running in bash. This case needs to be moved to a higher level engineer. Could you please attach the entire logfile to the case?

Assuring our best services all the time!

[Phil_James]

Latest response from CBC.

Hi Phil, The issue should have actually been resolved in the initial betas prior to the 3.5.1.19 release, and users should be able to install using any shell without issue. From taking a closer look at the screenshots, it looks like you may have renamed the unattended install script and that’s what resulted in the issues you are seeing. I’d suggest you against renaming or modifying the script to avoid this issue. The issue resulting from renaming the script will be fixed in the next release. Please do subscribe to the upcoming release version on the following page:- https://community.carbonblack.com/t5/Carbon-Black-Cloud-macOS-Sensor/tkb-p/release_notes_macos Please do let me know if you have any questions. Regards, Arun Kumar Technical Support Engineer Shift Time: 8:00 AM – 05:00 PM | Eastern Time | Monday – Friday

You can't rename the script. I'll test it today.

[obi-k]

From what I recall, I didn't rename or modify the unattended script.

[Phil_James]

Ya, thats not a solution for this issue. I'm not uploading the script, I'm copying the code in the script to Jamf Pro's script editor. Also.... you need to modify the script for it to work. You need to add the pkg path & company code?

[obi-k]

Yes, we added the script to Jamf. Punched in our package path and company code. We didn't rename the script or modify anything else, but we still saw the same errors.

[Phil_James]

Got it. Finally. Arun was right all along. Lose the spaces in the 'Display Name' for the script. First time I have had it run without any errors.

[sgiesbrecht]

@Phil.James thanks, I took out the spaces in the Display Name also and no issues / failures reported.

[obi-k]

I'm trying update version 3.5.1.23. It installs on the Mac client, but Jamf shows errors. I tried the no space thing before on a previous version, but no difference.

What am I doing wrong?

I use Composer to package the "CBDefense Install.pkg" and install it at private/var/tmp. From there, the unattended script with that location and the company code runs next.

[alexjdale]

Can you change the script name to remove the space and try again, then show us the log? We know that the space does lead to errors, and I've run the .23 unattended in a similar way with no errors.

[obi-k]

Thank you. That worked. Jamf shows green, completed. I double-checked my clean up a script to remove the CB installer from the private/var/tmp directory. That script had extra letters, so it messed things up. That was my bad.

Seems to be working. I'll try other clients.

[obi-k]

For a select few clients, the new CB Cloud just won't install even if Jamf has a green completed. These select few had issues with version 3.4.3.44, the "Confer.app" instead of VM Carbon BLack Cloud.

Here are the logs.