Carbon Black Cloud: How to Enable Nettrace (Verbose Network Logging)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

To enable NetTrace logging

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

1. Enable Nettrace

1. Place sensor into bypass mode by running commands:

   cd c:\Program Files\Confer\
   repcli bypass 1

2. Open the cfg.ini file with a text editor running as Admin
3. Add:

   Nettrace=1

4. Force a configuration update:

   repcli updateconfig

5. Remove device from bypass:

   repcli bypass 0

6. Replicate the issue
7. Gather a Repcli Capture

2. Disable NetTrace

1. Place sensor into bypass mode by running commands:

   cd c:\Program Files\Confer\
   repcli bypass 1

2. Open the cfg.ini file with a text editor running as Admin
3. Remove:

   Nettrace=1

4. Force a configuration update:

   repcli updateconfig

5. Remove device from bypass:

   repcli bypass 0

Additional Information

• This should only be done when requested by VMware Carbon Black Support/ Engineering
• Failure to disable NetTrace can lead to a full disk