CB Response: Linux Sensor 6.2.x cbdaemon.log Filling Drive Space

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• cbdaemon.log continuously logging data
• /var/opt/carbonblack/response/sensorsettings.ini *LogLevel is set to 'warning'

Environment

• CB Response Sensor: 6.2.2 and below
• Linux: All Supported Versions

Cause

LogLevel settings are case sensitive

Resolution

1. Upgrade to sensor version 6.3.0 for resolution

Working around older version:

1. Open a terminal with sudo privileges
2. Edit /var/opt/carbonblack/response/sensorsettings.ini
3. Update DaemonLogLevel and SensorLogLevel to "Warning"

   • DaemonLogLevel=Warning
     SensorLogLevel=Warning

4. Save changes
5. Restart cbdaemon

   • service cbdaemon restart

Additional Information

• Correct log level settings
  • None
  • Error
  • Warning
  • Info
  • Verbose