EDR: How to manually run the watchlist search job
search cancel

EDR: How to manually run the watchlist search job

book

Article ID: 290164

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To manually execute the watchlist search job

Environment

  • EDR Server: 6.x and higher

Resolution

From the main node of the EDR server, run the following:
sudo -u cb /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --master -s watchlist_search >> /var/log/cb/job-runner/startup.out 2>&1



 

Additional Information

  • Watchlist search is run by the 'cb' user by default
  • To add verbose logging during the execution add the -vvvv option
    • sudo -u cb /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --master -s -vvvv watchlist_search >> /var/log/cb/job-runner/startup.out 2>&1
  • Messages related to the execution of the above job will be logged in /var/log/cb/job-runner/startup.out by default. Regular watchlist_search information will be logged in /var/log/cb/job-runner/job-runner.log