App Control: How To Collect Agent Performance Logs on macOS (Locally)
search cancel

App Control: How To Collect Agent Performance Logs on macOS (Locally)


Article ID: 286731


Updated On:


Carbon Black App Control (formerly Cb Protection)


To collect diagnostics for cases involving performance impacts.


  • App Control Agent: All Supported Versions
  • macOS: All Supported Versions


Note: You will need the Global CLI Password to adjust the debug levels properly. Failure to authenticate with the Agent and set the proper debug levels will result in less data captured, which may prevent proper investigation into the issue.
  1.   Open Terminal and issue the following commands:
    cd /Applications/Bit9/Tools
    ./b9cli --password 'GlobalCLIPassword'
    ./b9cli --resetcounters
    ./b9cli --flushlogs
    ./b9cli --debuglevel 4
    ./b9cli --kerneltrace 4
    ./b9cli --nettrace 1
  2. Open the macOS Activity Monitor (Applications > Utilities > Activity Monitor).
  3. Click View > Update Frequency > Often (2 sec)
  4. Open the application experiencing the performance issues.
  5. Return to Activity Monitor, and double click the process with the performance issue. Click Sample.
  6. Once the Sample completes choose Save to export the results.
  7. In Terminal, capture the Agent Logs and return logging to defaults:
    ./b9cli --capture ~/Desktop/`Hostname`
    ./b9cli --password 'GlobalCLIPassword'
    ./b9cli --debuglevel 0
    ./b9cli --kerneltrace 2
    ./b9cli --nettrace 0
  8. Collect System Logs
    system_profiler -detailLevel full > ~/Desktop/sysinfo.txt
    tar -cvf ~/Desktop/`hostname`-DiagnosticReports.tar /Library/Logs/DiagnosticReports
  9. Upload all captured logs to the Vault and update the existing Support Case.