Troubleshooting Remote Log Collection Failing

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Agent logs fail to upload to the App Control Console (/support.php > Available Log Files) after being requested.

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Cause

The Agent sends these files via Port 443 to the Server Address. Typically is caused due to some sort of network timeout, SSL or other connectivity issue on this port between the endpoint and the application server.

Resolution

1. Test connectivity between the endpoint and the Server on port 443.
2. Verify the IIS Certificate bound to Port 443 is not expired, and formatted correctly:
   • Common Name shown should match Server Address from the General tab.
   • Expiration Date should be in the future.
   • A matching Certificate should be listed in the Trusted Communication Certificates list at the bottom of the Security tab, and Trusted.

 

If the issue persists

1. On the endpoint
   1. Enable debug levels specified in the Disconnected Agent Logs article.
   2. Be sure to also start a Packet Capture.
2. Send a request from the App Control Console to upload diagnostics, and wait for the failure.
3. Once the upload fails, capture logs and provide to Support.