Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR Sensor: How to Enable Debugging for LiveQuery

EDR Sensor: How to Enable Debugging for LiveQuery

Environment

  • EDR Windows Sensor: 7.1.0 and Higher
  • EDR Server: 7.2.0 and Higher

Objective

  • How can debug logging be enabled for LiveQuery?

Resolution

  • On the sensor that needs troubleshooting, enable debug logging to at least a '5'.  Please run the following commands:
reg add HKLM\Software\CarbonBlack\config -v MaxDebugLogSize -t REG_DWORD -d 1000000000 -f

reg add HKLM\Software\CarbonBlack\config -v DebugLevel -t REG_DWORD -d 5 -f 

sc control carbonblack 203
  • Once done, re-run the LiveQuery command and then pull a new sensordiag.  The changes will be denoted by debuglevel in the Sensor.log.  OsQuery items should now be showing up as queries are ran.

Additional Notes

  • Verbosity can be increased to avoid missing items by changing the -d <log level> number in the command above.  Examples, below:
reg add HKLM\Software\CarbonBlack\config -v DebugLevel -t REG_DWORD -d 6 -f
reg add HKLM\Software\CarbonBlack\config -v DebugLevel -t REG_DWORD -d 7 -f

 

Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎02-24-2021
Views:
460
Contributors