Collect "Rule Not Working" Logs for App Control Agent

Products

• Carbon Black App Control

Issue/Introduction

Steps to collect specific rule-processing logs for the App Control Agent  when a custom rule is not functioning as expected and standard historical logs lack sufficient detail.

Environment

• App Control Agent: All Supported Versions

Resolution

Windows

1. For rules that are User/Group specific: Log in as that user for the reproduction. As well, run this command as the user and provide the output to the case

   whoami /user /groups > "%userprofile%\Desktop\whoami.txt"

2. Launch an administrative command prompt issue the following commands:

   cd "C:\Program Files (x86)\Bit9\Parity Agent"
   dascli password GlobalCLIPassword
   dascli setconfigprop max_rolling_trace_size_mb=750
   dascli setconfigprop max_rolled_trace_logs_to_keep=5
   dascli flushlogs
   dascli resetcounters
   dascli debuglevel 6
   dascli kerneltrace 4
   dascli setconfigprop kernelVerboseLogPattern=*<filenameorpathhere>* 
   	Example: dascli setconfigprop kernelVerboseLogPattern=*blocked.dll*
   sc control parity 128

3. Reproduce the issue being reported.
4. Capture the logs and reduce the logging levels:

   dascli capture "%userprofile%\Desktop\%computername%.zip"
   dascli password GlobalCLIPassword
   dascli debuglevel 0
   dascli kerneltrace 2
   dascli setconfigprop max_rolling_trace_size_mb=50
   dascli setconfigprop max_rolled_trace_logs_to_keep=1
   dascli setconfigprop kernelVerboseLogPattern=""

5. Collect a CSV export of the Events reported by the Agent to in the Console by going to: Reports > Events.
   • Set the Saved View & Group By to (none)
   • Set the Max Age accordingly.
   • Be sure the Columns: Installer, Process, Rule Name, and User are included in the Columns.
   • Set the Filter to the relevant Source (Computer).
   • Click Export to CSV.
6. Capture a full screenshot of the entire Custom Rule, including all fields/sections.
7. Upload all collected data.

Linux

1. Increase the Agent's Debug Levels via Terminal

   cd /opt/bit9/bin
   ./b9cli --password GlobalCLIPassword
   ./b9cli --resetcounters
   ./b9cli --flushlogs
   ./b9cli --debuglevel 4
   ./b9cli --kerneltrace 4
   ./b9cli --nettrace 1

2. Recreate the issue
3. Capture the logs & reset the Debug Levels

   sudo ./b9cli --capture /var/tmp/$HOSTNAME.zip
   ./b9cli --password GlobalCLIPassword
   ./b9cli --debuglevel 0
   ./b9cli --kerneltrace 2
   ./b9cli --nettrace 0
   ./b9cli --flushlogs

4. Collect a CSV export of the Events reported by the Agent to in the Console by going to: Reports > Events.
   • Set the Saved View & Group By to (none)
   • Set the Max Age accordingly.
   • Be sure the Columns: Installer, Process, Rule Name, and User are included in the Columns.
   • Set the Filter to the relevant Source (Computer).
   • Click Export to CSV.
5. Capture a full screenshot of the entire Custom Rule, including all fields/sections.
6. Upload all collected data.

macOS

1. Open Terminal and increase the Agent's Debug Levels

   cd /Applications/Bit9/Tools
   ./b9cli --password 'GlobalCLIPassword'
   ./b9cli --resetcounters
   ./b9cli --flushlogs
   ./b9cli --debuglevel 4
   ./b9cli --kerneltrace 4
   ./b9cli --nettrace 1
   

2. Recreate the issue
3. Capture the logs & reset the Debug Levels

   ./b9cli --capture ~HOME/Desktop/$(hostname)-PerformanceLogs.zip
   ./b9cli --password 'GlobalCLIPassword'
   ./b9cli --debuglevel 0
   ./b9cli --kerneltrace 2
   ./b9cli --nettrace 0

4. Collect a CSV export of the Events reported by the Agent to in the Console by going to: Reports > Events.
   • Set the Saved View & Group By to (none)
   • Set the Max Age accordingly.
   • Be sure the Columns: Installer, Process, Rule Name, and User are included in the Columns.
   • Set the Filter to the relevant Source (Computer).
   • Click Export to CSV.
5. Capture a full screenshot of the entire Custom Rule, including all fields/sections.
6. Upload all collected data.

Additional Information

• The Windows command "sc control parity 128" is only available in command prompt and not in PowerShell, the command will cause the custom rules to re-expand on the Agent.
• If the issue cannot be reproduced this level of detail will not provide the insight required and a separate process for capturing diagnostic information may be required.