CB Response: Error: "Fail to delete inode"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Error in /var/log/messages:  "...Fail to delete inode..."

Example:

kernel: CbSensor: Fail to delete inode=17811223, pid=12345 from hash table

Environment

• CB Response Linux Sensor: 6.1.9 and Higher
• Linux: All Supported Versions

Cause

• This benign message occurs when the sensor software cleans up a file tracking list after a file close. The message means the sensor cannot find the entry in the list to delete it. But to get there, it has to have found it previously in some of its functions. This message may appear if a process has a file open twice. The sensor deletes it on the first close, so it is missing on the second close. 

Resolution

• No workaround available. You can safely ignore it. 

Additional Information

• In the vast majority of cases, this is a benign message.
• This message does not indicate a real problem exists.