Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Growth of datastore debug.log increases after upgrade to 5.2

Growth of datastore debug.log increases after upgrade to 5.2

Version

Cb Response 5.2

Issue

Growth of /var/log/cb/datastore/debug.log increases significantly after upgrade to 5.2.  This change in behavior can cause disk full issues depending on disk sizing for /var/log

Symptoms

/var/log/cb/datastore/debug.log shows error message containing the following message with high frequency after 5.2 upgrade:

com.carbonblack.cbfs.storage_model_4.DataStore$Engine$DataStoreOverflowException: Queue full

Cause

Product changes in 5.2 have increased the frequency of "Queue full" messages in /var/log/cb/datastore/debug.log under normal operation.  This is expected behavior and future product versions will reduce the frequency of logging for this message.

Solution

Should additional space requirement for increased logging cause disk full issues, the following solutions may be used to reduce disk usage:

1) Reduce backups retained:

Edit the /etc/cb/datastore/logback.conf.xml (master and all minions) and make the following change (restart is not necessary):

Change from:

<maxHistory>14</maxHistory>

to

<maxHistory>5</maxHistory>

2) If continued disk space issues are experienced even with only 5 backups retained, you may selectively turn off logging for EventLogSubmit2.

Edit the /etc/cb/datastore/logback.conf.xml (master and all minions) and make the following change (restart is not necessary):

Locate the following line:

<logger name="com.carbonblack.cbfs" level="WARN" />

and add the following line directly after it:

<logger name="com.carbonblack.cbfs.http.servlets.EventLogSubmit2" level="OFF" />

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-08-2016
Views:
931
Contributors