How to Enable Debug Logging on CB Enterprise

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Enable debug logging on CB Enterprise. 

Environment

• EDR Server: All supported versions

Resolution

1. Edit /etc/cb/enterprised-logger.conf
2. Change logger_root level from WARN to DEBUG:

• [logger_root]
  level=WARN
  handlers=syslog

• [logger_root]
  level=DEBUG
  handlers=syslog

Additional Information

• Debug logging can produce a lot of data. This should only be used when the problem can easily be reproduced
• The change does not require a restart of service(s).
• To disable debug logging, change the level back to WARN

  • [logger_root]
    level=WARN
    handlers=syslog