Environment
- CB Response Sensor: All Versions
- CB Response Server: All Versions
Question
What happens when a sensor's eventlog quota has been reached?
Answer
The sensor will stop collecting data until the eventlog size has gone down
Additional Notes
- This often happens when a sensor has been unable to reach the server back-end for a long time
- Once a sensor is able to send data back to the server, the search results for the last few days may return events older than that
