CB Response: How to Add a Log Removal Cron Job
search cancel

CB Response: How to Add a Log Removal Cron Job

book

Article ID: 289245

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Create a cron job to remove log files older than a certain amount of time

Environment

  • CB Response Server: All Versions
  • Linux: All Supported Versions

Resolution

  1. Edit the /etc/cb/cron/cb.cron.template file 
  2. Add the following line replacing <folder> with the folder to delete logs from 
  3. 0 0 * * * root find /var/log/cb/<folder> -name *.log -mtime +7 -delete
  4. Restart the CB Response services

Additional Information

  • To change the time the job runs, change the cron formatted value 0 0 * * * to the preferred runtime
  • To change the age of files to be deleted, edit the +7 value to the preffered number of days
  • For a non-permanent setting, add the line to /etc/cron.d/cb. The setting will be wiped in the next service restart according to what is in cb.cron.template