Add verbose logging for Nginx sensor communication

Products

• Carbon Black EDR

Issue/Introduction

Need to add additional verbose logging to Nginx for troubleshooting

Environment

• Carbon Black EDR Server: All Supported Versions
• Carbon Black EDR Sensors: All Supported Versions

Resolution

1. Log into the server via ssh/terminal
2. One /etc/cb/nginx/cb-nginx.conf
3. Add the following lines anywhere between the http{ tag 

       log_format custom '$remote_addr - $ssl_client_verify $client_cert $server_port "$ssl_protocol/$ssl_cipher" $ssl_client_s_dn [$time_local($request_time)] "$request" $status ">$upstream_addr" "$ssl_client_raw_cert"';
   
       access_log  /var/log/cb/nginx/access_custom.log custom;

4. Restart the nginx service: 

   /usr/share/cb/cbservice cb-nginx restart

    

5. After troubleshooting, this custom logger should be removed or commented out and service restarted

Additional Information

• This custom logger will provide additional information around the client certificate, ssl protocol and cipher, sensor group and port used by the sensor
• Output will write to /var/log/cb/nginx/access_custom.log. Normal logging will resume to /var/log/cb/nginx/access.log