Carbon Black Cloud: Linux sensor disconnected with "duplicate key name" error
search cancel

Carbon Black Cloud: Linux sensor disconnected with "duplicate key name" error

book

Article ID: 285360

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • Linux sensor "inactive" in console, but running on endpoint
  • \var\opt\carbonblack\psc\log\log.txt shows "duplicate key name"

Environment

  • Carbon Black Cloud Console: All Versions
  • Cb Defense Sensor: All support Linux versions

Cause

Incorrect/manual update to \var\opt\carbonback\psc\cfg.ini

Resolution

  1. Stop the sensor: https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Stop-Start-the-Sensor-via-Command-Line/ta-p/62500
  2. Fix the duplicate "key" entry in /var/opt/carbonblack/psc/cfg.ini (cfg.ini should only have a single entry for each key) by editing the file
  3. Start the sensor: https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Stop-Start-the-Sensor-via-Command-Line/ta-p/62500