Where are the sensor logs in Windows Sensor 3.6 and above?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Where are the sensor logs located in Sensor 3.6 and above?

Environment

• Carbon Black Cloud Windows Sensor: 3.6 and Higher
• Microsoft Windows: All Supported Versions

Resolution

• Sensor Logs are stored in %ProgramData%\CarbonBlack\Logs
• The cb-installer-x-x-x log (formerly confer-temp log) remains in either %LocalAppData%\Temp or %SystemRoot%\Temp depending on how the sensor was installed

Additional Information

• Please continue to use repcli capture to collect sensor logs when possible. See How To Collect Sensor Logs Locally (Windows) for details
• If repcli capture cannot be used (due to corrupt or incomplete install), please see Unable to save the Windows Sensor logs on 3.6 and above