Carbon Black Cloud: What Information Is needed for Performance Cases?

[#1]

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Question

What data is required to start an investigation into sensor performance issues?

Answer

Please provide:

1. Background information:
   1. The Device ID or Name of the impacted device.
   2. When the issue started occurring and if there were any changes that led up to it
   3. Any Applicable application names and the paths/processes involved when the impact occurs.
   4. Are there other 3rd party security applications installed? Have exclusions been configured?
      • Carbon Black Cloud Console: How to Set up Exclusions in the Carbon Black Cloud Console for other AV ...
      • Carbon Black Cloud: Recommended Third-Party Anti-virus Exclusions
   5. Is it reproducible? If yes, what are the steps?
      • Please attach any applicable screenshots to the case.
   6. Does placing the sensor into bypass mode resolve the issue?
2. Sensor Performance Logs:
   • Windows: Carbon Black Cloud: How To Collect Sensor Performance Logs (Windows)
   • Linux: Carbon Black Cloud: How to Run the Diagnostics Script for Linux
   • Mac: Carbon Black Cloud: How To Collect Sensor Logs Locally (Mac)

Additional Notes

Collecting performance logs requires repcli authentication. Please see:

• Endpoint Standard: How to Enable Authentication for RepCLI Utility
• Endpoint Standard: How to Enable RepCLI Authentication on Existing Sensors

Related Content

Carbon Black Cloud: How To Collect Sensor Logs Locally (Windows)
Carbon Black Cloud: How to Collect Process Monitor Logs (Windows)
Carbon Black Cloud: How to Collect a ProcDump