EDR: How does the MaxEventStoreSizeInMB option in cb.conf work?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How does the MaxEventStoreSizeInMB setting in cb.conf work?

Environment

• EDR console version: 6.1 and higher

Resolution

From the Server Configuration guide:

"By default, process data is purged automatically when disk space is required. If this parameter value is set, process data is unmounted or deleted, starting from the earliest date, until the size of the process store is less than the value.
This determines how big the total event store can get in MB before warm partitions are purged. When the threshold is reached, the oldest partition is either unmounted (converted to cold) or deleted from disk, based on value of AlwaysDeleteColdPartitions."

Additional Information

• The default value is 0
• More details on the MaxEventStoreSizeInMB page in the EDR Server Configuration guide