EDR: Disk Full Due to JSON Files
search cancel

EDR: Disk Full Due to JSON Files


Article ID: 289847


Updated On:


Carbon Black EDR (formerly Cb Response)


  • Disk space taken .json* files accumulating in /var/cb/data/ directory
  • Data retention is low


  • EDR Server: 6.X


Cb-event-forwarder is set to output as JSON files to space limited volume.


Currently there is no mechanism to clean up these JSON files on EDR product. Suggest using another volume with enough space, or create a cron job to purge these files. 

Additional Information

  • Output type is defined in /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf.
  • Add the lines below to the bottom of the '/etc/cb/cron/cb.cron.template' file to automatically remove the
    'event_bridge_output.json' files. The following will keep one week of 'event_bridge_output.json*' files by running once at midnight and
    removing any files modified over 7 days: 
    # Remove old event-forwarder files that were modified over 7 days ago. Runs once a night at midnight 
    0 0 * * * root find /var/cb/data -iname "event_bridge_output.json*" -mtime +7 -exec rm -f {} \; 
  • A restart of the services will be needed for changes to take affect: