EDR: How to Add a Cron Job to Clear Up Old Binary Files

[#1]

Environment

• EDR Server: All versions

Objective

Create a cron job to clear out binary files older than a set date.

Resolution

1. Edit /etc/cb/cron/cb.cron.template
2. Add the following above the last comment in the file

   • # Remove binary files older than XX days at 1am
        0 1 * * * root find /var/cb/data/modulestore -name "*.zip" -type f -mtime +XX -delete

3. Save the file
4. Restart services for the change to take effect

Additional Notes

• Actions must be run as a root user or with sudo privileges
• Binary metadata will still exist in the environment. 
• Without intervention, binary files will never be removed from the server. 
• Removing binary files can result in a situation where an endpoint has reported on a binary, but the file is not available. This happens when the binary had already been seen on the endpoint previously. Once a sensor reports on a binary, it will not try to upload the binary on consecutive interactions. The number of days old for the binary should be relatively high to reduce this edge case

Related Content

EDR: How to Enable Automated Cbmodule Purging
EDR: How To Purge Modulestore Binary Files