What is the current sensor version that is being installed on these devices?
What are the prior sensor version(s) that were installed (if any)?
How was the sensor deployed: the console, attended, unattended (command line), or third party deployment software e.g. SCCM, GPO, JAMF etc..?
If this is a sensor upgrade, what sensor version was installed and how was it deployed?
How many devices are exhibiting this behavior?
What is the device operating system(s)?
Is there an identifiable pattern where install/upgrades fail? (e.g. Does this issue happen only on a particular subnet, OS version or sensor version?)
Verbose.msi log (Always collect this log when possible)
If the sensor was installed via attended method, the verbose msi will not be generated
If sensor was upgraded via CBC Console then the msi.log will be located in %ProgramData%\CarbonBlack
If sensor was installed any other method then the verbose msi will only be created if /L*vx <logpath>\<logname> was used when installing the sensor. If the <logpath> was not specified, then the log will be created in whatever director that the msi was specified to run
TCP Dump (Collect only if we suspect a network issue and issue can be reproduced on demand)
All other Logs (Please contact support to obtain the cbcdisk-v2.ps1 sensor install log collection script)
The cbcdisk-v2.ps1 log collection script will automatically collect the sensor registration log cb-installer-<sensor.version>.log (post 3.4) or confer-temp.log (3.4 and below) which is usually found in one of the following locations: C:\Windows\TEMP\ C:\Users\<user>\AppData\Local\Temp\ C:\Users\All Users\AppData\Local\Temp
If there is a record for a device's hostname on one of the Inventory pages (Endpoints, VM Workloads, VDI Clones, etc.) where the Status shows Active but the Operating System (OS) and Sensor version fields are blank
Registration has succeeded (there is a device_id), but installation has failed