Where Does the Sensor Installation Process Store Logs on a Mac?
book
Article ID: 291236
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Carbon Black Cloud Enterprise EDR
Issue/Introduction
Where does the sensor installation process store logs on a Mac?
Environment
- Carbon Black Cloud Sensor: 3.0.x.x and Higher
- Apple macOS: All Supported Versions
Resolution
MacOS Sensor installation logs are stored in the following locations depending on installation status.
Install succeeds:
3.0.x.x - 3.4.x.x
- /Applications/Confer.app/confer-preinstall.xxxxxxxx.log
- /Applications/Confer.app/confer-postinstall.xxxxxxxx.log
3.5.x.x and Higher
- /Applications/Confer.app/cbcloud-preinstall-<timestamp>.log
- /Applications/Confer.app/cbcloud-postinstall-<timestamp>.log
- /Library/Application Support/com.vmware.carbonblack.cloud/Logs if Big Sur
Install fails:
3.0.x.x - 3.4.x.x
- /tmp/confer-preinstall.xxxxxxxx.log
- /tmp/confer-postinstall.xxxxxxxx.log (may not be present)
3.5.x.x and Higher
- /tmp/cbcloud-preinstall-<timestamp>.log
- /tmp/cbcloud-postinstall-<timestamp>.log (may not be present)
Additional Information
- The /tmp directory is a hidden directory
- The ability to view hidden files and folders can be toggled with the following keyboard shortcut beginning with macOS 10.13
Cmd+Shift+Period
- The /tmp directory is a symbolic link to the hidden /private/var/tmp directory
- Hidden directories can also be accessed with Finder by selecting Go > Go to Folder and entering the absolute file path
- The uninstallation of the Cb Defense Sensor will also write an uninstall log to the /tmp location
Feedback
thumb_up
Yes
thumb_down
No