To manually remove the modulestore binary files from an EDR server or cluster.
- Log onto the CLI of the EDR server. For a cluster, log into each minion server.
- Determine the MaxEventStoreDays setting in /etc/cb/cb.conf as a starting point to purge to:
# grep MaxEventStoreDays /etc/cb/cb.conf
- Get the list of which binaries will be removed:
# find /var/cb/data/modulestore -name "*.zip" -type f -mtime +XX &> /tmp/ls_purge_binary.txt
- Run the following replacing XX with MaxEventStoreDays results:
Warning: Verify your system time before running this command
find /var/cb/data/modulestore -name "*.zip" -type f -mtime +XX -delete
- Binaries uploaded from Sensors to the EDR cluster are located inside /var/cb/data/modulestore/
- These steps will irrecoverably remove data from the EDR server. After removing this data, attempting to download this binary from the binary details page will result in a 404.