CB Response: Linux Sensor 6.2.x cbdaemon.log Filling Drive Space
search cancel

CB Response: Linux Sensor 6.2.x cbdaemon.log Filling Drive Space

book

Article ID: 289641

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • cbdaemon.log continuously logging data
  • /var/opt/carbonblack/response/sensorsettings.ini *LogLevel is set to 'warning'

Environment

  • CB Response Sensor: 6.2.2¬†and below
  • Linux: All Supported Versions

Cause

LogLevel settings are case sensitive

Resolution

  1. Upgrade to sensor version 6.3.0 for resolution
Working around older version:
  1. Open a terminal with sudo privileges
  2. Edit /var/opt/carbonblack/response/sensorsettings.ini
  3. Update DaemonLogLevel and SensorLogLevel to "Warning"
    • DaemonLogLevel=Warning
      SensorLogLevel=Warning
  4. Save changes
  5. Restart cbdaemon
    • service cbdaemon restart

Additional Information

  • Correct log level settings
    • None
    • Error
    • Warning
    • Info
    • Verbose