Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: How to Collect Historical Agent Logs on macOS (Locally)

App Control: How to Collect Historical Agent Logs on macOS (Locally)

Environment

  • App Control Agent: All Supported Versions
  • macOS: All Supported Versions

Objective

This document describes the collection of diagnostics that will help Carbon Black Support with investigating a resolution for:

  • Unexpected Blocks
  • Unexpected Approvals
  • Unexpected Rule Results
  • Connectivity Issues
  • Agent or macOS Crash

Resolution

  1. Open Terminal and issue the following commands:
    cd /Applications/Bit9/Tools
    ./b9cli --capture ~/Desktop/`Hostname`-AgentLogs.zip
    
  2. If experiencing system crashes, or if otherwise instructed, collect the System Logs:
    system_profiler -detailLevel full > ~/Desktop/`hostname`-sysinfo.txt
    tar -cvf ~/Desktop/`hostname`-DiagnosticReports.tar /Library/Logs/DiagnosticReports
    
  3. Upload all captured logs to the Vault and update the existing Case in Support.

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎08-21-2018
Views:
1995
Contributors