CB Response: When the event log reaches its maximum size, does the log rollover or does it stop gathering all together?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When the event log reaches its maximum size, does the log rollover or does it stop gathering all together?

Environment

• CB Response Server: All Versions
• CB Response Sensor: All Versions

Resolution

If the endpoint runs out of space for sensor data, the sensor drops the newest data and keeps the old. New data will write to memory, in case there was an event that caused the machine to go offline.