Carbon Black Cloud: How to Clean up ScanHost.log and ScanHost.log.tmp Files

[#1]

Environment

• Endpoint Standard Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Objective

How to clean up Scanhost.log and Scanhost.log.tmp files in situations where they're larger than they're supposed to be.

Resolution

Remotely:

1. Clone the Policy
2. Edit the Local Scan tab, setting the Scanner Config option below:

   On-Access File Scanning Mode = Disabled

3. Move effected device to the new policy, and wait for it to receive the policy changes
4. Place the device temporarily into Bypass Mode, and wait for the device to receive this change
5. Launch GoLive
6. Navigate to the following location:

   C:\ProgramData\CarbonBlack\Logs

7. Delete Scanhost.log and ScanHost.log.tmp
8. Disable Bypass Mode
9. Move device back to original policy

Locally:

1. Place effected device into Bypass mode
2. Stop the services via repcli
3. Zip the file:

   C:\ProgramData\CarbonBlack\Logs\scanhost.log

4. Delete the file:

   C:\ProgramData\CarbonBlack\Logs\scanhost.log.tmp

5. Run the following to start services

   net start cbdefense

6. Bring the device out of Bypass mode

Related Content

Carbon Black Cloud: Scanhost.log.tmp File Consumes Excessive Disk Space