Carbon Black Cloud: Large number of event batch files on Linux
book
Article ID: 286138
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
- Large number of files named 'bulk_########' seen in /opt/carbonblack/psc/blades/E51C4A7E-2D41-4F57-99BC-6AA907CA3B40/behavior-events
- Sensor exceeding OER for disk space
Environment
- Carbon Black Cloud Sensor: 2.9.x.x - 2.12.x
- Linux: All Supported Versions
Cause
Issue with purging old event batch files after uploading to Cloud
Resolution
Upgrade to 2.13.1 or higher where this has been corrected (PSCLNX-9662)
Additional Information
If it is not possible to upgrade soon, the following can be done in the interim
- Stop agent
- Remove backlog of messages
rm /var/opt/carbonblack/psc/blades/E51C4A7E-2D41-4F57-99BC-6AA907CA3B40/behavior-events/ -f
- Restart agent
Feedback
thumb_up
Yes
thumb_down
No