EDR: Modulestore Filling Disk When Alliance Sharing Is Disabled

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Modulestore is taking up a large portion of /var/cb/data:

du -h /var/cb/data --max-depth=1

Environment

• EDR Server: All versions

Cause

This will occur if alliance sharing is disabled and a modulestore cron job is not in place.

Resolution

One or more of the following options will need to be put in place

1. Enable Binary sharing with Alliance
2. Enable cbmodule purge: How To Enable Automated Cbmodule Purging
3. Disable modulestore collection under sensor group settings
4. Increase disk size

Additional Information

• If the disk is already full, you can run this manual purge command to reduce stored modules: How To Purge Modulestore (Storefile Binary) Data
• Binaries cannot be downloaded from the binary details page if modulestore collection is disabled.
• All binary files that were recorded by the sensor before modulestore collection was disabled will still be uploaded. That data can be manually purged: How To Purge Modulestore (Storefile Binary) Data