EDR: Sensor logs to collect for general troubleshooting

[#1]

Environment

• EDR Sensor: All Versions (formerly CB Response)

Objective

Collect EDR sensor diagnostics for general troubleshooting. This guide should be used for:

• General connectivity problems with the server
  • Sensors that are on appearing as offline
  • Sensors that never appeared in the console
• Missed or Delayed data collection
• Installation issues while the service is running

Resolution

Follow steps below for a given OS platform to collect sensor diagnostics

Windows

• 6.2.1 and lower: EDR: How to Collect Windows Sensor Diagnostics Logs (6.2.1 and below)
• 6.2.2 and higher: https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-How-to-Collect-Windows-Sensor-Diagno...
• If a CB Protection Agent is installed, the CB Tamper Protect Updater must be disabled to gain read access to the Diagnostics folder on the Windows platform

MacOS

• 6.1.3 and lower: CB Response: How to generate Apple MacOS sensor report 6.1.3 and earlier
• 6.2 and higher: EDR: Generate Apple MacOS Sensor report in 6.2.x and later

Linux

• EDR: How to gather Linux sensor diagnostics

 

Related Content

• Collecting logs for BSOD/Kernel Panic Issues [Sensor - Cb Response]
• Collecting logs for System Hang Issues [Sensor - Cb Response]
• EDR Sensor: How to collect logs for performance-related issues (Windows)