Where Does the Sensor Installation Process Store Logs on a Mac?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

Where does the sensor installation process store logs on a Mac?

Environment

• Carbon Black Cloud Sensor: 3.0.x.x and Higher
• Apple macOS: All Supported Versions

Resolution

MacOS Sensor installation logs are stored in the following locations depending on installation status.

Install succeeds:

3.0.x.x - 3.4.x.x

• /Applications/Confer.app/confer-preinstall.xxxxxxxx.log
• /Applications/Confer.app/confer-postinstall.xxxxxxxx.log

3.5.x.x and Higher

• /Applications/Confer.app/cbcloud-preinstall-<timestamp>.log
• /Applications/Confer.app/cbcloud-postinstall-<timestamp>.log
• /Library/Application Support/com.vmware.carbonblack.cloud/Logs if Big Sur

Install fails:
 

3.0.x.x - 3.4.x.x

• /tmp/confer-preinstall.xxxxxxxx.log
• /tmp/confer-postinstall.xxxxxxxx.log (may not be present)

3.5.x.x and Higher

• /tmp/cbcloud-preinstall-<timestamp>.log
• /tmp/cbcloud-postinstall-<timestamp>.log (may not be present)

Additional Information

• The /tmp directory is a hidden directory
• The ability to view hidden files and folders can be toggled with the following keyboard shortcut beginning with macOS 10.13

Cmd+Shift+Period

• The /tmp directory is a symbolic link to the hidden /private/var/tmp directory
• Hidden directories can also be accessed with Finder by selecting Go > Go to Folder and entering the absolute file path
• The uninstallation of the Cb Defense Sensor will also write an uninstall log to the /tmp location