Cb Response: Configurations to mitigate out of disk issues in 6.1 and Higher

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Change settings in the Cb Response server environment to prevent future disk space issues. 

Environment

• Cb Response Server: 6.1 and higher

Resolution

1. Verify that OER disk requirements are being followed - Carbon Black Response v6.1 - Operating Environment Requirements
2. Verify MaxEventStoreDays and MaxEventStoreSizeInPercentare set to reasonable values in /etc/cb/cb.conf - Selecting an Event From the Alerts Page Results in a 404 Page
   • Note: changing these settings will require a service restart

3. Adjust Modulestore retention settings: Modulestore Filling Disk When Alliance Sharing Is Disabled

4. Enable automated purging of Cbmodules -  How To Enable Automated Cbmodule Purging
5. Set up a job to automatically clear old Datastore logs - https://community.carbonblack.com/t5/Knowledge-Base/Cb-Response-How-to-add-a-datastore-tmp-removal-cron-job/ta-p/62901