CB Response: What happens when a sensor's eventlog quota has been reached?
search cancel

CB Response: What happens when a sensor's eventlog quota has been reached?

book

Article ID: 289830

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What happens when a sensor's eventlog quota has been reached?

Environment

  • CB Response Sensor: All Versions
  • CB Response Server: All Versions

Resolution

The sensor will stop collecting data until the eventlog size has gone down

Additional Information

  • This often happens when a sensor has been  unable to reach the server back-end for a long time
  • Once a sensor is able to send data back to the server, the search results for the last few days may return events older than that