Carbon Black Cloud: Linux Sensor Exceeding OER for Disk Usage

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Linux sensor exceeding 4gb of disk space
• "psc_minibatch" files not being deleted

Environment

• Carbon Black Cloud Sensor: All Versions up to 2.9.0
• Linux OS: All Supported Versions

Cause

Sensor's event files were moved while sensor was running.

Resolution

1. Uninstall the sensor on the effected systems and completely remove anything in the /var/opt/carbonblack/psc/blades/E51C4A7E-2D41-4F57-99BC-6AA907CA3B40 directory.
2. Reinstall sensor
3. Avoid moving any files while the sensor is actively running

Additional Information

The upcoming 2.9.1 sensor will have additional code in place to prevent this behavior.  This is being tracked under UAV-1850.