EDR: How to Collect Windows Sensor Diagnostic Logs (6.2.2+)

[#1]

Environment

• EDR Sensors: 6.2.2 and Higher
• Microsoft Windows: All Supported Versions
• Microsoft .NET 4.5 and Higher

Objective

How to collect diagnostics using the sensordiags.exe tool

Resolution

1. Run Command Prompt as Administrator
2. Change directory to C:\Windows\CarbonBlack
3. Run the diagnostic tool

   sensordiag.exe --type CDE

4. Collect the C:\Windows\CarbonBlack\diags\<filename>.zip
   • If the zip file does not exist, use  CB Response: How to Collect Sensor Diagnostics Logs (6.2.1 and below) to generate sensor logs instead.
   • If errors are received due to Microsoft .NET 4.5 support when running the diagnostic tool, please use CB Response: How to Collect Windows Sensor Diagnostic Logs (6.2.1 and below).
   • If "Access Denied" is returned and Tamper Protection is enabled for the sensor's sensor group, use https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Collect-Windows-Sensor-Diagnostic-Log...
5. Send the diagnostic files to support using CBVault.

Additional Notes

• Available Switches

  -type XXX        - only mandatory parameter. Must be some combination of C,D, and E
                   --- Example: sensordiag --type CE
  
  -startdate yyyy-mm-dd [hh:mm:ss] - Only collects logs modified after a certain date/time
                   --- Time of day may/ may not be specified along with date
                   --- Example: sensordiag --type CE --startdate 2019-02-04 09:00:00
  
  -enddate yyyy-mm-dd [hh:mm:ss] - Only collects logs modified before a certain date/time
                   --- Time of day may/ may not be specified along with date
                   --- Can be used in conjunction with startdate parameter
                   --- Example: sensordiag --type CE --enddate 2019-02-10
  
  -remember        - Only collects logs modified since the last sensordiags run
                   --- Cannot use startdate and enddate with remember
                   --- Example: sensordiag --type CDE -remember
  
  -output C:\path\to\diag - Set the output directory to something other than the working directory 
  

• Types

  C: Crash - Returns crash reports for Carbon Black user-mode Service
  
  D: Diagnostics - Returns information about the sensor. Includes the contents of all subfolders of C:\Windows\CarbonBlack, as well as install information and metadata about the sensor drivers' status
  
  E: Environment - Collects system-wide information via WMI queries

• Each collection will overwrite the last. If multiple diagnostics need to be collected, move the current outside the C:\Windows\CarbonBlack\Diags path.
• Requires Microsoft .NET 4.5 and Higher
• If the server has diagnostic collection enabled (under sharing settings), the sensor will automatically send up any logs from C:\Windows\CarbonBlack\diags\. If the upload succeeds, it deletes them locally

Related Content

https//community.carbonblack.com/t5/Knowledge-Base/CB-Response-Generate-Windows-sensor-report/ta-p/67648
EDR: Enable verbose logging locally on Windows sensor
https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-How-to-collect-a-Procmon-for-Sensor-...
EDR: How to collect a Procmon for Boot/Login Sensor Performance
How to Collect a WPR (Windows Performance Recorder) Trace
EDR: Sensor logs to collect for general troubleshooting
How to Collect Event Viewer logs
How to Disable/Enable the Carbon Black Tamper Protection Updater within Carbon Black Enterprise Prot...
EDR: How to collect logs for performance-related issues (MacOS)
https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-Sensor-How-to-collect-logs-for-perfo...
.NET Framework system requirements