IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

EDR: How to manually run the watchlist search job

EDR: How to manually run the watchlist search job

Environment

  • EDR Server: 6.x and higher

Objective

To manually execute the watchlist search job

Resolution

From the main node of the EDR server, run the following:
sudo -u cb /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --master -s watchlist_search >> /var/log/cb/job-runner/startup.out 2>&1



 

Additional Notes

  • Watchlist search is run by the 'cb' user by default
  • To add verbose logging during the execution add the -vvvv option
    • sudo -u cb /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --master -s -vvvv watchlist_search >> /var/log/cb/job-runner/startup.out 2>&1
  • Messages related to the execution of the above job will be logged in /var/log/cb/job-runner/startup.out by default. Regular watchlist_search information will be logged in /var/log/cb/job-runner/job-runner.log

Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎08-30-2021
Views:
294
Contributors