Gather logs for Windows Sensor version 6.2.2+

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to collect logs and other diagnostics for the EDR Windows Sensor 6.2.2 and higher using the sensordiags.exe tool.

Environment

• EDR Sensors: 6.2.2 and Higher
• Microsoft Windows: All Supported Versions
• Microsoft .NET 4.5 and Higher

Resolution

1. Run Command Prompt as Administrator
2. Change directory to C:\Windows\CarbonBlack
3. Run the diagnostic tool

   sensordiag.exe --type CDE

4. Collect the C:\Windows\CarbonBlack\diags\<filename>.zip
   • If the zip file does not exist, use Gather logs for Windows Sensor version 6.2.1 and below to generate sensor logs instead.
   • If errors are received due to Microsoft .NET 4.5 support when running the diagnostic tool, use Gather logs for Windows Sensor version 6.2.1 and below.
   • If "Access Denied" is returned and Tamper Protection is enabled for the sensor's sensor group, use Collecting Windows Sensor Diagnostic Logs With Tamper Protection Enabled
5. If necessary, upload the diagnostic files to the tech support case record.

Additional Information

• Available Switches

  -type XXX        - only mandatory parameter. Must be some combination of C,D, and E
                   --- Example: sensordiag --type CE
  
  -startdate yyyy-mm-dd [hh:mm:ss] - Only collects logs modified after a certain date/time
                   --- Time of day may/ may not be specified along with date
                   --- Example: sensordiag --type CE --startdate 2019-02-04 09:00:00
  
  -enddate yyyy-mm-dd [hh:mm:ss] - Only collects logs modified before a certain date/time
                   --- Time of day may/ may not be specified along with date
                   --- Can be used in conjunction with startdate parameter
                   --- Example: sensordiag --type CE --enddate 2019-02-10
  
  -remember        - Only collects logs modified since the last sensordiags run
                   --- Cannot use startdate and enddate with remember
                   --- Example: sensordiag --type CDE -remember
  
  -output C:\path\to\diag - Set the output directory to something other than the working directory 
  

• Types

  C: Crash - Returns crash reports for Carbon Black user-mode Service
  
  D: Diagnostics - Returns information about the sensor. Includes the contents of all subfolders of C:\Windows\CarbonBlack, as well as install information and metadata about the sensor drivers' status
  
  E: Environment - Collects system-wide information via WMI queries

• Each collection will overwrite the last. If multiple diagnostics need to be collected, move the current outside the C:\Windows\CarbonBlack\Diags path.
• Requires Microsoft .NET 4.5 and Higher
• If the server has diagnostic collection enabled (under sharing settings), the sensor will automatically send up any logs from C:\Windows\CarbonBlack\diags\. If the upload succeeds, it deletes them locally