Where to Find the Live Response Log files

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To locate the various log files used for EDR Live Response.

Environment

• EDR Server: All Supported Versions

Resolution

Live Response activity is logged on both the EDR server running Live Response and the sensors it accesses.

Sensor Log:

• sensor.log:  Located on the endpoint in the sensor installation folder (eg, C:\Windows\CarbonBlack).

Server logs:

• /var/log/cb/liveresponse/debug.log - General debug information.
• /etc/cb/liveresponse-logger.conf - Change log levels for debug.log.
• /var/log/cb/audit/live-response.log - audit all LiveResponse command activity.
• /var/cb/data/live-response - Directory where all "get" and "put" files are placed. Also contains output of all commands.