App Control: How to Collect High Debug Agent Logs on Windows (Locally)

[#1]

Environment

• App Control Agent: 7.x and Higher
• Microsoft Windows: All Supported Versions

Objective

To collect agent logs locally on windows machines

Resolution

1. Access the target device.
2. Open an elevated command prompt.
3. Run the following commands in order

   • cd C:\Program Files (x86)\Bit9\Parity Agent
     dascli password <Enter the agent CLI or global password without the brackets>
     dascli resetcounters
     dascli debuglevel 6
     dascli kerneltrace 4
     dascli nettrace 1

4. If able to recreate the issue, do so now. If not, let the agent sit for 10 - 15 minutes unless otherwise specified by support.
5. To collect the diagnostics that were generated and return the agent to normal logging levels, run the following commands in order:

   • dascli password <Either the CLI or global password can be entered here without the brackets>
     dascli debuglevel 0
     dascli kerneltrace 2
     dascli nettrace 0
     dascli capture <Path>\<COMPUTERNAME>.zip

6. Upload the resulting zip file to the CB Vault.
7. Once upload is complete, please comment in the case that the files should be available for review.

 

Additional Notes

If the system is 32 bit, use C:\Program Files\Bit9\Parity Agent for the path instead of Program Files (x86).

Related Content

How to Collect Event Viewer logs
App Control: How to Collect Historical Agent Logs (Remotely)
CB Response: Generate Windows sensor report
Cb Protection: Remote Collecting logs for troubleshooting (Mac/Linux OS)
Cb Protection Agent Logs Continue Increasing In Size
App Control: How To Collect Logs for Active Directory Integration Troubleshooting
Carbon Black Protection: How to collect CAPI2 or CAPIMON logs for Files