EDR: Multiple Instance of Cron Jobs Causing Deadlock

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Multiple cron jobs running and watchlist run not able to complete

<warning> [statsmon] Another instance of the same job statsmon is already running 
<warning> [binary_purge] Another instance of the same job binary_purge is already running 
<warning> [watchlist search] Another instance of the same job watch11St search is already running 
<warning> [binary purge] Another instance of the same job binary purge is already running 
<warning> [watchlist search] Another instance of the same job watchlist search IS already running 
<warning> [statsmon] Another instance of the same job statsmon is already running

 

Environment

• EDR(Formerly Carbon Black Response) Server: All Supported Versions

Cause

• Duplicate cron file present under /etc/cron.d
• which causes deadlock situation as multiple jobs are accessing for same resource.

Resolution

Delete the duplicate file under  /etc/cron.d and make sure there is no backup of the same file under same directory.

Additional Information

• Restart crond service after restart

To restart the cron service, use:
# /etc/init.d/crond restart
OR RHEL/CentOS 5.x/6.x user:
# service crond restart
OR RHEL/Centos Linux 7.x user:
# systemctl restart crond.service