Collecting Sensor Diagnostic Logs for Troubleshooting (all platforms)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Collect EDR sensor diagnostics for general troubleshooting. This guide should be used for:

• General connectivity problems with the server
  • Sensors that are on appearing as offline
  • Sensors that never appeared in the console
• Missed or Delayed data collection.
• Installation issues while the service is running.
• Most other technical support cases related to the endpoint running an EDR sensor.

Environment

• EDR Sensor: All Versions
• Microsoft Windows: all supported versions
• Linux: all supported versions
• macOS: all supported versions

Resolution

Follow steps below for a given OS platform to collect sensor diagnostics

Windows

• Gather logs for Sensor version 6.2.2 and higher
• Gather logs for Sensor version 6.1.13 and lower
• Enable Verbose Debug Logging Locally on Windows sensor
• Enable Verbose Debug Logging Remotely on Windows Sensor
• Collect Diagnostic Logs for Sensor Performance-Related Issues (Windows)
• Collect Diagnostic Logs for Sensor Connection Issues (Windows)
• Collecting Windows Sensor Diagnostic Logs With Tamper Protection Enabled
  
  
• If an App Control Agent is installed, the Tamper Protection Updater must be disabled to gain read access to the Diagnostics folder on the Windows platform

MacOS

• Gather logs for Sensor version 6.1.3 and lower
• Gather logs for Sensor version 6.2.0 and higher
• Gather logs for performance related issues
• Gather Trace logs to troubleshoot macOS Sensors

Linux

• Gather logs for Sensor (all versions)
• Gather logs for performance related issues