EDR: How to enable debug logging on Linux

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To enable debug logging in 6.3.x Linux sensors

Environment

• EDR Linux Sensor: 6.3.x
• Linux OS: All Supported Versions

Resolution

1. Edit: /var/opt/carbonblack/response/sensorsettings.ini
2. Set:

DaemonLogLevel=verbose

3. Save the changes.
4. Reload the cbdaemon process:

# killall cbdaemon -SIGHUP

5. Look for the increased logs in: /var/opt/carbonblack/response/log/cbdaemon.log

Additional Information

• Important: this applies to Linux Sensor 6.3.0 and higher. Increased logging for 6.2.1 - 6.2.2 does not work, and versions prior to that use different instructions. 
• The default log level is 'info'
• Available log levels, in ascending order of increased logging:  none, error, warning, info, verbose
• Log level values are case insensitive