Carbon Black Cloud: Linux sensor disconnected with "duplicate key name" error

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Linux sensor "inactive" in console, but running on endpoint
• \var\opt\carbonblack\psc\log\log.txt shows "duplicate key name"

Environment

• Carbon Black Cloud Console: All Versions
• Cb Defense Sensor: All support Linux versions

Cause

Incorrect/manual update to \var\opt\carbonback\psc\cfg.ini

Resolution

1. Stop the sensor: https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Stop-Start-the-Sensor-via-Command-Line/ta-p/62500
2. Fix the duplicate "key" entry in /var/opt/carbonblack/psc/cfg.ini (cfg.ini should only have a single entry for each key) by editing the file
3. Start the sensor: https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Stop-Start-the-Sensor-via-Command-Line/ta-p/62500