Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Cb Response: Configurations to mitigate out of disk issues in 6.1 and Higher

Cb Response: Configurations to mitigate out of disk issues in 6.1 and Higher

Environment

  • Cb Response Server: 6.1 and higher

Objective

Change settings in the Cb Response server environment to prevent future disk space issues. 

Resolution

  1. Verify that OER disk requirements are being followed - Carbon Black Response v6.1 - Operating Environment Requirements
  2. Verify MaxEventStoreDays and MaxEventStoreSizeInPercentare set to reasonable values in /etc/cb/cb.conf - Selecting an Event From the Alerts Page Results in a 404 Page
    • Note: changing these settings will require a service restart
  3. Adjust Modulestore retention settings: Modulestore Filling Disk When Alliance Sharing Is Disabled

  4. Enable automated purging of Cbmodules -  How To Enable Automated Cbmodule Purging
  5. Set up a job to automatically clear old Datastore logs - EDR: How to add Datastore and Solr debug.tmp removal cron job

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎01-10-2019
Views:
626
Contributors