EDR: Nginx shows exited too quickly (process log may have more details) FATAL

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• cb-nginx service status shows:

Exited too quickly (process log may have more details) FATAL

• /var/log/cb/supervisord/supervisord.log shows:

INFO gave up: cb-nginx entered FATAL state, too many start retries too quickly

• /var/log/cb/nginx/startup.log shows:

nginx: [emerg] "proxy_intercept_errors" directive is duplicate in /etc/cb/nginx/conf.d/includes/cb.server.error:5

Environment

• EDR Server: All Supported Versions
• Linux: All Supported Versions

Cause

The following line is included in multiple files:

include /etc/cb/nginx/conf.d/includes/cb.server.error;

Resolution

1. Check /etc/cb/nginx/conf.d/cb.conf and /etc/cb/nginx/conf.d/includes/cb.server.body to see if both have the following line:

include /etc/cb/nginx/conf.d/includes/cb.server.error;

2. Comment the above line in /etc/cb/nginx/conf.d/cb.conf;
3. Restart the CB services and issue should be resolved.