EDR: How to create a symbolic link to move the /var/log/cb data location

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Explain how to create a symbolic link in the Linux OS to relocate the log file data for the EDR product to a different location without breaking the product functionality.

Environment

• EDR: All Versions
• Linux OS: All Supported Versions

Resolution

1. Stop the server/cluster: EDR: How to Restart Server Services
2. Make a location for the logs directory on the disk you want to move the data
   • Example: mkdir -p /apps/var/log
3. Move the existing logs:
   • mv /var/log/cb /apps/var/log/cb
4. Create a symbolic link:
   • ln -s /apps/var/log/cb /var/log/cb
5. Modify the cb-redis configuration to explicitly point to the new log location.
   • Edit the file /etc/cb/redis.conf
   • Look for the line "logfile /var/log/cb/redis/redis.log"
   • Change the path to point to the new log file location for this service; using the example shown here it would be changed to:
     • logfile /apps/var/log/cb/redis/redis.log
   • Save the file
6. Modify the cb-rabbitmq configuration to explicitly point to the new log location.
   • Edit the file /etc/cb/rabbitmq/rabbitmq-env.conf.
   • Look for the line "RABBITMQ_LOG_BASE=/var/log/cb/rabbitmq"
   • Change the path to point to the new log file location for this service; using the example shown here it would be changed to:
     • RABBITMQ_LOG_BASE=/apps/var/log/cb/rabbitmq
   • Save the file
7. Start the server/cluster: EDR: How to Restart Server Services

Additional Information

• Logging should continue to work as expected at new location, but if not, open a Support case with Carbon Black
• Log rotation still works correctly, and does rotate the logs and delete old ones (advanced system time and invoked log rotate, confirmed older logs were gone as expected)
• CBDiag utility can still pull logs from the symlinked location
• The cb-redis and cb-rabbitmq services, which are based on third-party software, are apparently unable to write log files to a symlink, and must be configured to explicitly use the new location (see instructions above). However, their log files can still be accessed using the symlink.