EDR: Nginx shows exited too quickly (process log may have more details) FATAL
search cancel

EDR: Nginx shows exited too quickly (process log may have more details) FATAL

book

Article ID: 287500

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • cb-nginx service status shows:
Exited too quickly (process log may have more details) FATAL
  • /var/log/cb/supervisord/supervisord.log shows:
INFO gave up: cb-nginx entered FATAL state, too many start retries too quickly
  • /var/log/cb/nginx/startup.log shows:
nginx: [emerg] "proxy_intercept_errors" directive is duplicate in /etc/cb/nginx/conf.d/includes/cb.server.error:5

Environment

  • EDR Server: All Supported Versions
  • Linux: All Supported Versions

Cause

The following line is included in multiple files:
include /etc/cb/nginx/conf.d/includes/cb.server.error;

Resolution

1. Check /etc/cb/nginx/conf.d/cb.conf and /etc/cb/nginx/conf.d/includes/cb.server.body to see if both have the following line:
include /etc/cb/nginx/conf.d/includes/cb.server.error;
2. Comment the above line in /etc/cb/nginx/conf.d/cb.conf;
3. Restart the CB services and issue should be resolved.