Adding a Cron Job to Clear Up Old Binary Zip Files

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Create a cron job to clear out binary files older than a set date.

• Filling Disk.
• Not sharing binaries with Alliance. 
• KeepAllModuleFiles is set to 1.

Environment

• Carbon Black EDR: All Versions

Resolution

1. Edit /etc/cb/cron/cb.cron.template (must be added to each node in a cluster)
2. Add the following above the last comment in the file, adjusting mtime to the oldest file storage to keep:

   • # Remove binary files older than XX days at 1am
        0 1 * * * root find /var/cb/data/modulestore -name "*.zip" -type f -mtime +XX -delete

3. Save the file.
4. Restart services for the change to take effect: How to Start, Stop and Restart EDR Application Services

Additional Information

• Actions must be run as a root user or with sudo privileges.
• Binary (searchable) metadata will still exist in the environment. 
• Attempting to download the binary from the binaries page will result in a 404. 
• Removing binary files can result in a situation where an endpoint has reported on a binary, but the file is not available. This happens when the binary had already been seen on the endpoint previously. Once a sensor reports on a binary, it will not try to upload the binary on consecutive interactions. The number of days old for the binary should be relatively high to reduce this edge case