How To Configure Disk Space Usage for Sensor Events and Binaries

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

How can the maximum disk usage be configured for sensors in regards to events and queued data?

Environment

• EDR Server: All Supported Versions
• EDR Sensor: All Supported Versions

Resolution

"Sensor-side Max Disk Usage" is configurable from the EDR Admin UI under the Sensors > Sensor Group settings > Advanced section.

Additional Information

• The default values are 1024MB or 2%. The sensor will limit client-side storage to the smaller of the two values.
• The configuration is total disk space used by both storefiles (physical binaries zips) and events (searched event and binary metadata). It is split in two, if 1024 and 2% disk, it's going to be 514 and 1% disk for each type. If set to 4096 and 6% disk, expect 2048 and 3% disk for each type. Events type will always take the higher amount, for example if 3% disk was given, it would be 2% for events, 1% for storefiles.