How To Configure Disk Space Usage for Sensor Events and Binaries
search cancel

How To Configure Disk Space Usage for Sensor Events and Binaries

book

Article ID: 289425

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response) Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

How can the maximum disk usage be configured for sensors in regards to events and queued data?

Environment

  • EDR Server: All Supported Versions
  • EDR Sensor: All Supported Versions

Resolution

"Sensor-side Max Disk Usage" is configurable from the EDR Admin UI under the Sensors > Sensor Group settings > Advanced section.

Additional Information

  • The default values are 1024MB or 2%. The sensor will limit client-side storage to the smaller of the two values.
  • The configuration is total disk space used by both storefiles (physical binaries zips) and events (searched event and binary metadata). It is split in two, if 1024 and 2% disk, it's going to be 514 and 1% disk for each type. If set to 4096 and 6% disk, expect 2048 and 3% disk for each type. Events type will always take the higher amount, for example if 3% disk was given, it would be 2% for events, 1% for storefiles.