CB Response: What happens when a sensor's eventlog quota has been reached?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What happens when a sensor's eventlog quota has been reached?

Environment

• CB Response Sensor: All Versions
• CB Response Server: All Versions

Resolution

The sensor will stop collecting data until the eventlog size has gone down

Additional Information

• This often happens when a sensor has been  unable to reach the server back-end for a long time
• Once a sensor is able to send data back to the server, the search results for the last few days may return events older than that