You can update Carbon Black Cloud Linux sensors through the command line.

Procedure

  1. Sign into the endpoint.
  2. Download the updated sensor file; see To download sensor kits.
  3. For Linux sensor versions prior to 2.15, unpack the agent tar ball into: /var/opt/carbonblack/psc/pkgs/upgrade_staging/ If you have not previously updated the sensor, this folder does not exist and you must create it.
    For Linux sensors 2.15+, you can unpack the tarball and run the commands from any directory.
  4. Run the update script:

    RPM:

    $rpm -U cb-psc-sensor-xxx.rpm

    Note:
    • For the RHEL sensors kit, you must specify the rpm package that corresponds to the distro version that you are installing.
    • Run the following command to upgrade sensors that are deployed on an Amazon Linux 2 Graviton EC2 instance: 
      $ rpm -U cb-psc-sensor-<BUILD-NUMBER>.al2.aarch64.rpm --nodeps

    el6 → centos/rhel/oracle 6.0-6.x

    el7 → centos/rhel/oracle 7.0-7.x

    el8 → centos/rhel/oracle 8.0-8.x

    el9 → centos/rhel/oracle 9.0-9.x

    DEB:

    $dpkg --force-confold -i cb-psc-sensor-xxx.deb

  5. Verify the following:
    • Agent is upgraded — /opt/carbonblack/psc/bin/cbagentd -v to make sure that the agent matches the version you installed.
    • Kernel or BPF module is loaded.
      • Kernel module: Run the following command and verify that there is a 1 in the right column of the output. This shows that the kernel module is loaded and enabled. Other versions of the kernel might display as disabled; this is acceptable.

        Command: lsmod | grep event_collector

        Sample output:  event_collector_2_x_yyyyyy zzzzz 1

      • BPF module: Run the following command and verify that the grep returns a single result with the command event_collector.

        Command: ps -e | grep event_collector

        Sample output: 85150 ? 00:00:05 event_collector

    • Check agent-blade details on the Endpoints page in the console:
      • Updated agent details are displayed
      • Agent checks in with the server at regular intervals
    • For both Kernel and BPF, to see if the agent was successfully upgraded, you can check the build by running the following command: 
      cat /var/opt/carbonblack/psc/log/log.txt | grep -i upgrade

      This command works for either server upgrade or manual upgrade.