CB Response: What happens when a sensor's eventlog quota has been reached?
book
Article ID: 289830
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
What happens when a sensor's eventlog quota has been reached?
Environment
- CB Response Sensor: All Versions
- CB Response Server: All Versions
Resolution
The sensor will stop collecting data until the eventlog size has gone down
Additional Information
- This often happens when a sensor has been unable to reach the server back-end for a long time
- Once a sensor is able to send data back to the server, the search results for the last few days may return events older than that
Feedback
thumb_up
Yes
thumb_down
No