EDR: Command to Perform Full Backup of Server Failing

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Running following command to perform full backup of EDR server abruptly fails: tar -P --selinux -cvf cbdata.tar /var/cb/
• Running df -k command shows '/' drive 100% full

Environment

• EDR Server: All Versions
• Backup/Restore 

Cause

Backup command was being run within the '/' directory, which was filling the '/' partition.

Resolution

Run backup command within a directory that contains enough disk space to not fill partition e.g., /var/cb.