EDR: How to manually run the watchlist search job

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To manually execute the watchlist search job

Environment

• EDR Server: 6.x and higher

Resolution

From the main node of the EDR server, run the following:

sudo -u cb /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --master -s watchlist_search >> /var/log/cb/job-runner/startup.out 2>&1

 

Additional Information

• Watchlist search is run by the 'cb' user by default
• To add verbose logging during the execution add the -vvvv option

  • sudo -u cb /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --master -s -vvvv watchlist_search >> /var/log/cb/job-runner/startup.out 2>&1

• Messages related to the execution of the above job will be logged in /var/log/cb/job-runner/startup.out by default. Regular watchlist_search information will be logged in /var/log/cb/job-runner/job-runner.log