Gather logs for macOS Sensor version 6.2.0+

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to collect logs and other diagnostics for the EDR macOS Sensor 6.2.0 and higher.

Environment

• EDR Sensor: 6.2.0 and Higher
• macOS: All Supported Versions

Resolution

• 6.x OSX Sensor:

1. Open the Terminal app
2. Run:

sudo /Applications/CarbonBlack/sensordiag -type CDE

3. Optionally, gather logs from a specified date and later:

sudo /Applications/CarbonBlack/sensordiag -type CDE -startdate 2018-06-29

• 7.0.1+ OSX Sensor:

1. Open the Terminal app
2. Run:

sudo /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Helpers/sensordiag -type CDE

3. Optionally, gather logs from a specified date and later:

sudo /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Helpers/sensordiag -type CDE -startdate 2018-06-29

Additional Information

• Optional -startdate parameter format is YYYY-MM-DD.
• The resulting file will be generated in the current working directory.