Carbon Black Cloud: Linux sensor disconnected with "duplicate key name" error
book
Article ID: 285360
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
- Linux sensor "inactive" in console, but running on endpoint
- \var\opt\carbonblack\psc\log\log.txt shows "duplicate key name"
Environment
- Carbon Black Cloud Console: All Versions
- Cb Defense Sensor: All support Linux versions
Cause
Incorrect/manual update to \var\opt\carbonback\psc\cfg.ini
Resolution
- Stop the sensor: https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Stop-Start-the-Sensor-via-Command-Line/ta-p/62500
- Fix the duplicate "key" entry in /var/opt/carbonblack/psc/cfg.ini (cfg.ini should only have a single entry for each key) by editing the file
- Start the sensor: https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-to-Stop-Start-the-Sensor-via-Command-Line/ta-p/62500
Feedback
thumb_up
Yes
thumb_down
No