EDR Server: How to remove historic sensors from the WebUI (7.1.1 and below)
search cancel

EDR Server: How to remove historic sensors from the WebUI (7.1.1 and below)

book

Article ID: 289117

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to remove offline sensors that still appear in the WebUI

Environment

  • EDR Server Console

Resolution

  1. Connect to the Cb Response cluster Master server via SSH
vi /etc/cb/cb.conf
  1. Add the following value to the bottom of the file:
    • SensorLookupInactiveFilterDays=30
  2. Save the cb.conf file
  3. You will need to restart CB for the change to take effect- https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-restart-services/ta-p/41294

Additional Information

  • When 'SensorLookupInactiveFilterDays' is set to 0, it is not active (disabled)
  • All disconnected sensors for longer than the value will be removed from view in the WebUI, but their entry in the database table will remain
  • Documents and Events related to removed sensors will still exist in the SOLR database