CB Response: Duplicate messages being sent through rsyslog
search cancel

CB Response: Duplicate messages being sent through rsyslog

book

Article ID: 287783

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Rsyslog showing duplicated messages on SIEM.
  • Messages show up twice in the logs with different timestamp formats: 
    2019-01-24 21:01:18 [9236] <warning> reason=feed.storage.hit type=event process_guid=
    Jan 24 21:01:18 [9236] <warning> reason=feed.storage.hit type=event process_guid=
    

Environment

  • CB Response Server: All Versions

Cause

This can be due to duplicate entries in the rsyslog conf file: /etc/rsyslog.d/00-cbio-remote.conf 

Resolution

  1. Remove the duplicated setting from the /etc/rsyslog.d/NAME_OF_FILE.conf file. Example below:
    # Set up the actions 
    if $programname == 'cb-notifications' then /var/log/cb/notifications/cbio-all-notifications.log;CbLogFormatWithPID 
    $ActionQueueFileName cb_syslog_queue # unique name prefix for spool files 
    $ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible) 
    $ActionQueueSaveOnShutdown on # save messages to disk on shutdown 
    $ActionQueueType LinkedList # run asynchronously 
    $ActionResumeRetryCount -1 # infinite retries if host is down 
    & @@(o)<IPADDR>;CbLogFormatWithPID 
    & ~ 
    Remove lines starting here ---> if $programname startswith 'cb-notifications-' then /var/log/cb/notifications/cbio-all-notifications.log;CbSyslogStandardFormatWithPID
    $ActionQueueFileName cb_syslog_queue # unique name prefix for spool files
    $ActionQueueMaxDiskSpace 1g # 1gb space limit (use as much as possible)
    $ActionQueueSaveOnShutdown on # save messages to disk on shutdown
    $ActionQueueType LinkedList # run asynchronously
    $ActionResumeRetryCount -1 # infinite retries if host is down
    & @@(o)<IPADDR>;CbLogFormatWithPID
    & ~ <--- End after here
  2. Restart rsyslog services: 
    service rsyslog restart