App Control: How to Change Agent Event Retention

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

To change the number of events an Agent keeps before purging.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Resolution

1. Log in to the Console and navigate to https://ServerAddress/agent_config.php
2. Click Show Filters > Value > contains > report_event_max_size > Apply
3. Click View Details (pencil icon) and adjust the Value accordingly. Example:

   report_event_max_size=7500

4. Verify the Status shows as Enabled, then click Save.
5. Change the Filter > Value > contains > report_event_prune_percent > Apply
6. Click View Details (pencil icon) and adjust the Value accordingly. Example:

   report_event_prune_percent=8

7. Verify the Status shows as Enabled, then click Save.

Additional Information

• These settings are set to Disabled by default which forces the hardcoded values specified.
• By default the max Events stored are 5,000 (report_event_max_size=5000)
• By default the max percentage of Events pruned is 10% (report_event_prune_percent=10)