EDR: CBstats CSV file stops writing logs
search cancel

EDR: CBstats CSV file stops writing logs


Article ID: 288649


Updated On:


Carbon Black EDR (formerly Cb Response)


  • CBStats with output.format CSV stops writing information to the log file.
  • It is generally observed when the logfile rotates.(usually at midnight)
  • The issue was first observed on 7.4.2, and is continued in 7.5


  • EDR server: 7.4 & 7.5


The cbstats output is failing to handle HUP (Hang-up) signals to rotate and point to new file descriptors as set after the rotation.


  • The issue is being tracked under CB-36825 and will be fixed in future release.


  • As a workaround cb-logrotate.conf  can be updated:
1. Edit /etc/cb/cb-logrotate.conf :
  • Update /var/log/cb/cli/.log* to /var/log/cb/cli/cli.log (in first section of all the service logs)
  • Add another file to the list (/var/log/cb/cli/cbstats.log) :
  • Save & Quit.
2.  Empty out and/or copy over all the existing cbstats.log* from /var/log/cb/cli/

3. Execute:

logrotate --force -d /etc/cb/cb-logrotate.conf

 4. Restart cb enterprise services.