How To Configure Disk Space Usage for Sensor Events and Binaries
book
Article ID: 289425
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)Carbon Black Hosted EDR (formerly Cb Response Cloud)
Issue/Introduction
How can the maximum disk usage be configured for sensors in regards to events and queued data?
Environment
EDR Server: All Supported Versions
EDR Sensor: All Supported Versions
Resolution
"Sensor-side Max Disk Usage" is configurable from the EDR Admin UI under the Sensors > Sensor Group settings > Advanced section.
Additional Information
The default values are 1024MB or 2%. The sensor will limit client-side storage to the smaller of the two values.
The configuration is total disk space used by both storefiles (physical binaries zips) and events (searched event and binary metadata). It is split in two, if 1024 and 2% disk, it's going to be 514 and 1% disk for each type. If set to 4096 and 6% disk, expect 2048 and 3% disk for each type. Events type will always take the higher amount, for example if 3% disk was given, it would be 2% for events, 1% for storefiles.