EDR: Datastore logs consuming excessive disk space

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• /var/log/cb/datastore is several GB in size
• /var/log/cb/datastore contains several datastore.tmp files several months old

Environment

• EDR (formerly Cb Response) Server: 6.1 - 7.0.1

Cause

This is a known issue - CB-14090

Resolution

• Upgrade to server version 7.1 or higher
• Create a custom cron job to remove old datastore.tmp logs - https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-add-a-datastore-tmp-removal-cron-job/ta-p/62901