EDR: CBstats CSV file stops writing logs
book
Article ID: 288649
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- CBStats with output.format CSV stops writing information to the log file.
- It is generally observed when the logfile rotates.(usually at midnight)
- The issue was first observed on 7.4.2, and is continued in 7.5
Cause
The cbstats output is failing to handle HUP (Hang-up) signals to rotate and point to new file descriptors as set after the rotation.
Resolution
- The issue is being tracked under CB-36825 and will be fixed in future release.
- As a workaround cb-logrotate.conf can be updated:
1. Edit /etc/cb/cb-logrotate.conf :
2. Empty out and/or copy over all the existing cbstats.log* from /var/log/cb/cli/
3. Execute:
logrotate --force -d /etc/cb/cb-logrotate.conf
4. Restart cb enterprise services.
Feedback
thumb_up
Yes
thumb_down
No