CB Response: The 6.2.1 Linux Sensor is installing components into new directories that the CB Response User's Guide specifies

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

The directory files used prior to the 6.2.1 Linux sensor don't exist with the 6.2.1 sensor:

• /var/lib/cb/config Settings file
• /var/lib/cb/sensorsettings.ini Settings file 
• /var/lib/cb/sensorsettings.ini Settings file 
• /var/lib/cb/sensor_comms.log

Environment

• CB Response Sensor: 6.2.1 Linux sensors and greater
• CB Response Server: All versions
• Linux: All supported versions

Cause

The 6.2.1 sensor now installs into new directories.

Resolution

These files and directories can now be found in /var/opt/carbonblack/response

# ls -l
total 36
-rw-r--r-- 1 root root 7168 Jun 27 2018 carbonblack.db
-rw-r--r-- 1 root root 55 Nov 8 15:04 config.ini
drwxr--r-- 3 root root 4096 Nov 8 15:09 eventlogs
drwxr-xr-x 2 root root 4096 Nov 8 15:04 log
drwxr-xr-x 2 root root 4096 Nov 8 15:04 pkgs
-rw-r--r-- 1 root root 4678 Nov 8 15:04 sensorsettings.ini
drwxr--r-- 2 root root 4096 Nov 8 15:01 store

and /opt/carbonblack/response/bin

[root@hsessvm0107 tmp]# ls -l /opt/carbonblack/response/bin/
total 176156
-rwxr-xr-x. 1 root root 146 Aug 15 21:12 cbdaemonrestart.sh
-rwxr-xr-x. 1 root root 3386 Aug 15 21:12 sensordiag.sh
-rwxr-xr-x. 1 root root 3553 Aug 15 21:12 sensortop.sh
-rwxr--r--. 1 root root 2040 Aug 15 21:12 sensoruninstall.sh