EDR Server: How to remove historic sensors from the WebUI (7.1.1 and below)
book
Article ID: 289117
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
How to remove offline sensors that still appear in the WebUI
Environment
EDR Server Console
Resolution
Connect to the Cb Response cluster Master server via SSH
vi /etc/cb/cb.conf
Add the following value to the bottom of the file:
SensorLookupInactiveFilterDays=30
Save the cb.conf file
You will need to restart CB for the change to take effect- https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-restart-services/ta-p/41294
Additional Information
When 'SensorLookupInactiveFilterDays' is set to 0, it is not active (disabled)
All disconnected sensors for longer than the value will be removed from view in the WebUI, but their entry in the database table will remain
Documents and Events related to removed sensors will still exist in the SOLR database