CB Protection: External Analysis Tool Missing Event Data Due to Disk Space

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Events from CB Protection console not appearing in External Analytics such as Splunk
• ReporterLog-<Date>.log (found in Server log collection) contains error such as:
  • 2019-05-08 19:25:16,034 [16] ERROR DatabaseConnectionWrapper - Database task exception: MetadataTrace - There is not enough space on the disk.
    2019-05-08 19:25:16,048 [16] WARN  ProcessingContext         - System.IO.IOException: There is not enough space on the disk.

Environment

• CB Protection Server: All Supported Versions
• External Analysis Enabled within System Configuration > External Analytics

Cause

• Lack of disk space in Export Directory

Resolution

1. Login to the CB Protection Console
2. Navigate to System Configuration (gear icon) > External Analytics tab
3. Confirm the "Export Directory" specified has available disk space

Additional Information

ReporterLog-<Date>.log can be collected by following instructions outlined here: https://community.carbonblack.com/t5/Knowledge-Base/CB-Protection-Collecting-Logs-Remotely-for-Troubleshooting-CB/ta-p/65478