EDR: Alerts not being generated for Watchlists.

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Watchlist hits are reported on the Watchlist page, however events are not appearing in the Triage Alerts page.
• /var/log/cb/datastore directory contains large amount of debug.log#######.tmp files

Environment

• EDR Server: 6.2.3

Cause

 Known issue with the datastore.debug.log files, to be addressed in future release. 
 

Resolution

1. Open the /etc/cb/cron/cb.cron.template file to edit 
2. Set cronjob to remove .tmp files from '/var/log/cb/datastore/' older than 7 days:

   0 0 * * * root find /var/log/cb/datastore -name *.tmp -mtime +7 -delete

Additional Information

• Troubleshooting reveals an inordinate amount of 'datastore.debug.log' files:

  find /var/log/cb/datastore/ -mtime +1 -name 'debug.log*' | wc -l