CB Response: How to Add a Log Removal Cron Job

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Create a cron job to remove log files older than a certain amount of time

Environment

• CB Response Server: All Versions
• Linux: All Supported Versions

Resolution

1. Edit the /etc/cb/cron/cb.cron.template file 
2. Add the following line replacing <folder> with the folder to delete logs from 
3. 0 0 * * * root find /var/log/cb/<folder> -name *.log -mtime +7 -delete
4. Restart the CB Response services

Additional Information

• To change the time the job runs, change the cron formatted value 0 0 * * * to the preferred runtime
• To change the age of files to be deleted, edit the +7 value to the preffered number of days
• For a non-permanent setting, add the line to /etc/cron.d/cb. The setting will be wiped in the next service restart according to what is in cb.cron.template