Collect Interoperability Logs for Carbon Black Cloud Sensor

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Workload

Issue/Introduction

Steps to locally collect interoperability logs for the Carbon Black Cloud Sensor on Windows to identify and troubleshoot software conflicts with third-party applications.

Note: Interoperability logs should be collected when experiencing conflicts where no actual block is happening. If there are actual block events, please refer to Troubleshooting Unexpected Blocks in Carbon Black Cloud

Environment

• Carbon Black Cloud Sensor: All supported versions

Resolution

Note: Troubleshooting cannot take place with the sensor uninstalled. Support will need access to a device with the sensor installed and experiencing the issue.

Open a case with Carbon Black Support and the provide the following:

1. Relevant Information:
   • Date/Time interoperability issue occurred (did any change precede the start of it?)
   • Application name experiencing interoperability
   • Does the vendor of the application have a recommended exclusion list and has it been implemented?
   • Any paths/processes known to be associated with the application (This can be derived from a procmon capture)
   • Are there any blocks seen locally or within the Carbon Black console during the interop issue?
   • Is there any other security software which could be scanning the sensor or the application in question?
   • If there is other security software running is Carbon Black scanning it?
   • Action being performed when interop issue occurs (Expected outcome vs actual outcome)
   • Are results the same if the sensor is in bypass mode or uninstalled?
2. Sensor Logs:
   1. For Windows OS: Collect a standard procmon capture
   2. Collect sensor logs:
      • Collect Historical (Non-Debug) Logs for Carbon Black Cloud Sensor
   3. Zip all files and upload them to the case
      • Uploading files to cases on the Broadcom Support Portal
   4. Once the upload completes, please comment on the support case that the data is available for review (along with all relevant information).