EDR: How to find the sensors with large Event/Binary queue size

[#1]

Environment

• EDR: All supported versions
• Linux: All supported versions

Objective

Provide information of how to find the sensors with large queue size

Resolution

1. Logged into EDR console
2. Go to Sensors page and select the group of sensor to check
3. Click Export -> Export Visible (or Export All) to download the export CSV
4. Open CSV and Sort by column "num_eventlog_bytes" for Event queue size check, and by column "num_storefiles_bytes" for Binary queue size check

Related Content

EDR: Aggregate sensor event queue is growing too large
https://community.carbonblack.com/t5/Knowledge-Base/EDR-Sensor-Backlog-Grows-Unexpectedly-Large/ta-p...
EDR: Sensors Queueing Data Despite Checking Into Server