App Control: How to Enable Kernel Driver Logging on Startup (macOS)
book
Article ID: 286744
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Steps to enable the Agent's Kernel Driver logging on startup.
Environment
- App Control Agent: All Supported Versions
- macOS: All Supported Versions
Resolution
- Open a command prompt and change directory to /Applications/Bit9/Tools.
- Run the following commands in order:
./b9cli password <type the CLI or global password here>
./b9cli kerneltrace 4
- Run './b9cli status' to verify that the Kernel Level shows "4/0FFFFFFF"
- Reproduce the issue for logging
- Run the following commands to turn logging back down:
./b9cli password <type the CLI or global password here>
./b9cli kerneltrace 2
- Run 'dascli status' to verify that the Kernel Level shows "2/007FFFFFF"
- Zip the folder /Library/Application Support/com.bit9.Agent/Data and get a copy of the system.log from /var/log.
Additional Information
Ensure that step 5 is followed every time, high debugging logs can quickly fill up a harddrive.
Feedback
thumb_up
Yes
thumb_down
No