CB Connect 2020 early-bird discount pricing expires on January 31. Learn more and reserve your spot today!
cancel
Showing results for 
Search instead for 
Did you mean: 

CB Response Sensor: How to collect logs for performance-related issues (Windows)

CB Response Sensor: How to collect logs for performance-related issues (Windows)

Environment

  • CB Response Sensor: 6.x and Higher
  • Microsoft Windows: All Supported Versions

Objective

To collect relevant logs on a Microsoft Window endpoint in order to troubleshoot most performance-related issues. Typical issues may include:
  • General system performance issues
  • High CPU/Memory of CB Response sensor process
  • High CPU/Memory of third-party applications

Resolution

  1. Log onto the Windows endpoint exhibiting performance issues. 
  2. If necessary, disable CB Tamper Protect: CB Protection: How to Disable/Enable the Carbon Black Tamper Protect Updater
  3. Enable verbose logging (optional): CB Response: How to Enable Verbose Logging Locally on Windows Sensor
  4. Collect a Procmon capture: CB Response: How to collect a Procmon for Sensor Performance
  5. Collect a Windows Performance Recording: CB Response: Using Windows Performance Recorder
  6. Generate a Windows sensor report: CB Response: How to Collect Sensor Diagnostic Logs (6.2.2+) 
  7. Disable verbose logging (if previously enabled)
  8. Upload all log files to CB Vault
  9. Update your Carbon Black Technical Support case with further relevant information:
- Is the performance issue a reproducible scenario and if so, what steps, if any, are taken to reproduce it? 
(For example, were any backups, updates, or large file transfers being performed?)

- How many endpoints are affected? What are their general system profiles and function? 

- What other security applications/real-time scanners are installed?

- How long do the performance issues last? 

- What actions, if any, return the system performance to normal?

- Is the endpoint connected to to any network shares? 

- Does this endpoint generate a large number of logs, binaries, or PDF reports?

Additional Notes

  • Not all logs above may be required to troubleshoot every performance-related issue.

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
0% helpful (0/1)
Article Information
Author:
Creation Date:
‎02-08-2016
Views:
7782