EDR: How To Purge Modulestore Binary Files
search cancel

EDR: How To Purge Modulestore Binary Files


Article ID: 285278


Updated On:


Carbon Black EDR (formerly Cb Response)


To manually remove the modulestore binary files from an EDR server or cluster.  


  • EDR: 5.x and higher


  1. Log onto the CLI of the EDR server. For a cluster, log into each minion server. 
  2. Determine the MaxEventStoreDays setting in /etc/cb/cb.conf as a starting point to purge to:
    # grep MaxEventStoreDays /etc/cb/cb.conf
  3. Get the list of which binaries will be removed:
    # find /var/cb/data/modulestore -name "*.zip" -type f -mtime +XX &> /tmp/ls_purge_binary.txt
    (Alternately, confirm by printing to the screen the filenames and dates.)
    # find /var/cb/data/modulestore -name "*.zip" -type f -mtime +XX -printf "%s %n %t\n"
  4. Run the following replacing XX with MaxEventStoreDays results:
    Warning: Verify your system time before running this command
    find /var/cb/data/modulestore -name "*.zip" -type f -mtime +XX -delete

Additional Information

  • Binaries uploaded from Sensors to the EDR cluster are located inside /var/cb/data/modulestore/
  • These steps will irrecoverably remove data from the EDR server. After removing this data, attempting to download this binary from the binary details page will result in a 404.