EDR: Nginx Startup Error for Address "Already in Use"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Nginx will not start with error messages in /var/log/cb/nginx/startup.log similar to the following

[emerg] 46849#46849: bind() to [::]:443 failed (98: Address already in use) 
[emerg] 46849#46849: bind() to [::]:8443 failed (98: Address already in use) 
[emerg] 46849#46849: bind() to [::]:80 failed (98: Address already in use)

Environment

• EDR Server: All Versions

Cause

Another application is using the same port

Resolution

1. Confirm nginx was not started outside the cb-enterprise commands

   service nginx stop
   service cb-nginx stop
   

2. Check for any other processes using that port. Note: change the ports to match your errors

   netstat -tulpn | egrep '80|8443|443|nginx'

3. Kill the process using the port, in this example port 80

   fuser -k 80/tcp

4. Start the cb-nginx service

   service cb-nginx start

Additional Information

• Make sure to run "service cb-nginx" rather than "service nginx" when trying to start nginx
• In some case Fuser will kill the PID but the service will create a new one. Use the netstat output to track down the service still running and stop it