Carbon Black Cloud Sensor: Canary Files Consuming Large Amount Of Space On Servers.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Large number of canary files gets created in C:\Users\<Username> folder or on other Temp folders in servers.

Environment

• Carbon Black Cloud Sensor: Version 3.0 and higher
• Microsoft Windows: All Supported Versions

Cause

This issue is likely due to a backend defect that increases the growth of the Canary files.

Resolution

Open up a Support Case with Carbon Black team and provide the below details:

• Collect the sensor logs on the affected machine.
• Provide us the directories list where the canary files consume more space.
• Run the command "repcli canary getfiles" and it will get the active canary file list.