EDR: Modulestore Filling Disk When Alliance Sharing Is Disabled

[#1]

Environment

• EDR Server: All versions

Symptoms

Modulestore is taking up a large portion of /var/cb/data:

du -h /var/cb/data --max-depth=1

Cause

This will occur if alliance sharing is disabled and a modulestore cron job is not in place.

Resolution

One or more of the following options will need to be put in place

1. Enable Binary sharing with Alliance
2. Enable cbmodule purge: How To Enable Automated Cbmodule Purging
3. Disable modulestore collection under sensor group settings
4. Increase disk size

Additional Notes

• If the disk is already full, you can run this manual purge command to reduce stored modules: How To Purge Modulestore (Storefile Binary) Data
• Binaries cannot be downloaded from the binary details page if modulestore collection is disabled.
• All binary files that were recorded by the sensor before modulestore collection was disabled will still be uploaded. That data can be manually purged: How To Purge Modulestore (Storefile Binary) Data

Related Content

How To Enable Automated Cbmodule Purging
How To Purge Storefile (Modulestore Binary) Data