EDR: Where are Memdumps Stored from a Live Response Session?
search cancel

EDR: Where are Memdumps Stored from a Live Response Session?

book

Article ID: 291082

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Where are memory dump files stored after being uploaded to the server via a Live Response session?

Environment

  • EDR Sensor: 6.x and Higher
  • Live Response: All Versions

Resolution

/var/cb/data/live-response/sessions

Additional Information

  • This is the default directory.
  • If the DatastoreRootDir directory is not set to "/var/cb/data" then check the location, "/live-response/sessions".
  • The default format is .dmp
Powered by Wolken Software