Collect High Debug Windows Agent Logs

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to collect high debug App Control agent logs

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

 

Method 1: Remotely Pull Logs Via The App Control Console

1. Log in to the App Control Console
2. Navigate to Assets > Computers > click into relevant Computer.
3. From the right hand side select Other Actions > Delete Diagnostic Files on Computer.
4. From the right hand side select "Set Debug Level"
   • Set Debug Level to High with the "Include Kernel" checked
   • Set Debug Duration to 15 minutes
   • Select "Upload Diagnostic Files when Completed"
5. Recreate the issue.
6. After about 20 minutes: navigate to Tools > Requested Files > Diagnostic Files > download relevant logs.

Method 2: Collect Logs Locally Via Admin CMD Prompt

1. Login to the endpoint in question.
2. Open an admin CMD prompt.
3. Issue the following commands:

   cd "C:\Program Files (x86)\Bit9\Parity Agent"
   dascli password GlobalCLIPassword
   dascli resetcounters
   dascli debuglevel 6
   dascli kerneltrace 4
   dascli nettrace 1

4. Reproduce the issue
5. Issue the following commands:
   

   cd "C:\Program Files (x86)\Bit9\Parity Agent"
   dascli password GlobalCLIPassword
   dascli debuglevel 0
   dascli kerneltrace 2
   dascli nettrace 0
   dascli capture "%userprofile%\Desktop\%computername%-HDL.zip"