Cb Response: Coreservices not starting, detected unhandled Python exception in /usr/bin/gunicorn

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Coreservices is failing to start. /var/log/messages shows the following error message

  Jul 13 16:58:52 ResponseServer abrt-server[5106]: Not saving repeating crash in '/usr/bin/gunicorn'
  Jul 13 16:58:57 ResponseServer abrt: detected unhandled Python exception in '/usr/bin/gunicorn'

Environment

• Carbon Black Response Server: All Versions

Cause

/etc/cb/coreservices-logger.conf has leftover verbose debug loggers with non-existent keys

Resolution

1. Open /etc/cb/coreservices-logger.conf
2. Find the line [Loggers]
3. Confirm all keys exist and add or revert to the default keys (see below)

   keys=root, gunicorn.access

Additional Information

Default keys should be used during normal operation. Custom loggers should only be used during troubleshooting sessions where verbose logging is necessary. Leaving custom loggers on can cause disk space to fill up quickly if left on.