CB Response: Core Services fails to start with SSO debug enabled

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• /etc/cb/coreservices-logger.conf [loggers] section looks like this

keys=root, gunicorn.access 
cb.flask.blueprints.api_routes_saml, saml2​​

• Error during startup

ConfigParser.ParsingError: File contains parsing errors: /etc/cb/coreservices-logger.conf 
[line 69]: 'cb.flask.blueprints.api_routes_saml, saml2\n'

 

Environment

• CB Response Server: 6.x and Higher

Cause

Content was added into coreservices-logger.conf with the wrong format.

Resolution

1. Open /etc/cb/coreservices-logger.conf
2. Edit the [loggers] keys field to be a single line

keys=root, gunicorn.access, cb.flask.blueprints.api_routes_saml, saml2

3. Start services

Additional Information

This can happen if the values were copied from the integration guide, which contains a line break between the keys due to PDF formatting restrictions