Large number of event batch files on Linux exceeding disk space

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Large number of files named 'bulk_########' seen in /var/opt/carbonblack/psc/blades/E51C4A7E-2D41-4F57-99BC-6AA907CA3B40/behavior-events
• Sensor exceeding OER for disk space limit

Environment

• Carbon Black Cloud Linux Sensor: 2.9.x and Higher
• Linux OS: All Supported Versions

Cause

Issue with purging old event batch files after uploading to Cloud.

Resolution

Upgrade to CBC Linux sensor version 2.13.1 or higher where this has been corrected (PSCLNX-9662).

Additional Information

Potential workaround to clear disk space:

1. Stop agent
2. Remove backlog of messages

   sudo rm /var/opt/carbonblack/psc/blades/E51C4A7E-2D41-4F57-99BC-6AA907CA3B40/behavior-events/ -f

3. Restart agent