Collecting Logs for Linux System Crash

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

When a Linux system experiences a kernel panic or unexpected reboot, diagnostic files (like vmcore) are required to identify the root cause. This is important for investigating conflicts with other software.

Environment

• App Control Agent: All supported versions
• Linux Operating System: All supported versions

Resolution

1. Collect and zip the crash dump files that are written by default to: /var/crash and /var/log

   sudo tar cvfz /var/tmp/$HOSTNAME-CrashLogs.tgz /var/crash
   sudo tar cvfz /var/tmp/$HOSTNAME-SystemLogs.tgz /var/log

2. If the vmcore files are missing, verify that the Kdump service is active using steps in this KB
3. Check if the default path for writing crash logs has been modified in the config file: /etc/kdump.conf
4. Collect the Agent Historical Logs:

   cd /opt/bit9/bin
   sudo ./b9cli --capture /var/tmp/$HOSTNAME-AgentLogs.tgz

5. Output of the kernel version:

   uname -a