Cannot generate cbdiag - "No space left on device"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Attempts to run /usr/share/cb/cbdiag fail with message "No space left on device"

Environment

• EDR Server: All Supported Versions

Cause

There is no space left either in the location the command was run or the temporary directory files were stored during diag generation

Resolution

• Resolve drive space issues. 
• Workarounds
  • Use a different temporary directory with sufficient space

    /usr/share/cb/cbdiag --tmpdir=/path/to/tmp/dir

Additional Information

• An incomplete cbdiag may still be taking up disk space in the temporary location. Delete the file if present. Diag is dropped in the current working directory, however it writes files during the creation to /tmp. This KB article forces the writes to a new path with more space. 
• OER recommends
  • 10 GB free for root / drive (OS files and Installed applications)
  • 75 GB free for /tmp (diagnostics and Solr)
  • /var/log/cb should be 70% of RAM for logs and memory dumps. If disk is partitioned to just /var an extra 10GB should be added for OS and other application log files.