App Control: How to Enable Server Service Trace Logging from Startup
book
Article ID: 290894
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
How to set App Control Server services to debug level 6 in the registry for troubleshooting. This is to capture logs on boot time
Environment
App Control Server (Formerly CB Protection): All Supported Versions
Resolution
If the server has the App Control Agent installed turn off tamper protection following the below steps. If not please skip to step 2.
Open a command prompt as Administrator
Change directory to C:\Program Files (x86)\Bit9\Parity Agent (or the location where App Control is installed)
Turn off the tamper protect by doing the following commands in order
dascli password <Either the CLI or global password can be entered here without the brackets>
dascli tamperprotect 0
Stop the "Parity Server" service.
Go to services.msc and stop CB Protection Server service or run the command as Administrator “net stop ParityServer”
Open the Registry (go to Start > Run > type regedit > click OK)
Browse to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\ParityServer
Edit the registry value called “ImagePath” by adding “ /debuglevel 6” on the very end of the registry data. Below is an example of what it should look like
WARNING: Make sure to remove “ /debuglevel 6”, so it will return to the default level 0. Otherwise, the logs will keep growing and use unneccessary disk space
If registry key has been reset to default and debugging is still being written to the Serverlog.bt9 file, go to https://<servername>/Support.php > Diagnostics Tab > Click on Snapshot Server Logs. This will collect the Serverlog.bt9 file in the Diagnostics folder and end the debugging.