Enable Sensor Debug Logging for Issue Reproduction with RepCLI

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

How to Enable Sensor debug logging during issue reproduction 

Environment

• Endpoint Standard Sensor: All supported versions
• Microsoft Windows: All supported versions

Resolution

1. Launch a Command Prompt
2. Change directory to C:\Program Files\Confer
3. Run the following command or  

   C:\Program Files\Confer> repcli unlock <sensor_uninstallCode> 
   C:\Program Files\Confer> repcli debug 1
   Sensor is in debug mode

4. Enable any additional logging tools, such as Process Monitor or packet capture utilities
5. Reproduce the issue
6. Stop and save all other logging utilities 
7. Run the following command to gather Sensor logs

   C:\Program Files\Confer> repcli capture
   Captured diagnostic data in C:\Windows\TEMP\confer-temp\confer_dump.zip

8. Run the following command to disable Sensor debug logging

   C:\Program Files\Confer> repcli debug 0
   Sensor is not in debug mode

9. Gather all logs and attach to case as needed

Additional Information

• Sensor debug logging will increase confer.log verbosity
• Sensor debug logging will raise kernel logging to the Info level so the Microsoft Event Trace Log File will include additional data 
• RepCLI authentication isn't required if using repcli unlock but can be enabled manually on individual sensors