EDR: Enable Verbose Debug Logging Remotely on Windows Sensor
search cancel

EDR: Enable Verbose Debug Logging Remotely on Windows Sensor

book

Article ID: 285757

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • How to enable verbose user and kernel-mode logging remotely via CB Live Reponse.

Environment

  • EDR Sensor: All Versions
  • EDR Console: All Versions
  • Microsoft Windows: All Supported Versions

Resolution

  1. Back up the registry prior to enabling logging
  2. Remotely enable verbose logging:
    • Establish a CB Live Response session with the endpoint
    • Enter the following two commands within CB Live Response:
reg add HKLM\Software\CarbonBlack\config -v DebugLevel -t REG_DWORD -d 7
reg add HKLM\Software\CarbonBlack\config -v KernelDebugLevel -t REG_DWORD -d 7
  • The registry setting will not take affect until the user-mode sensor service is restarted
execfg cmd.exe /K "sc control carbonblack 203"
  1. Reproduce the issue
  2. Collect logs: 
  • https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Collect-Windows-Sensor-Diagnostic-Logs-6-2-2/ta-p/73140
  • https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Collect-Windows-Sensor-Diagnostics-Logs-6-2-1-and/ta-p/67648
  1. Disable verbose logging in Live Response
    • reg delete HKLM\Software\CarbonBlack\config /v DebugLevel /f
      reg delete HKLM\Software\CarbonBlack\config /v KernelDebugLevel /f
      execfg cmd.exe /K "sc control carbonblack 203"
  2. Upload the diagnostics to the CB Vault