Changing the Archive Event Log Location

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

This article explains how to the change the archive events history.

Environment

• App Control Server: All Supported Versions

Resolution

1. Log in to the Console and navigate to https://ServerAddress/shepherd_config.php
2. Select the Property ArchivedEventsFolder
3. Adjust the Value for the new location with a trailing slash, example:

   E:\Archive Events\

4. Save the changes

Additional Information

• The App Control Service Account needs to be able to write and edit to the new destination.
• Any existing Event Logs are not automatically copied to the new destination.
• The Shepherd Config Property ArchiveTrimTime defines the number of weeks to retain (default is 52).
• Unlike Event times shown in the Console, timestamps for the Archived Events listed in the CSV files are shown in UTC time
• The default archive location is:

  C:\Program Files (x86)\Bit9\Parity Server\ArchiveLogs\