Cb Defense: How do I manually retrieve the PSC Linux logs?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How do I manually retrieve the PSC Linux logs?

Environment

• Carbon Black Defense PSC Linux Sensor 2.1.0.149
• CentOS, RHEL 6 & 7

Resolution

1. Bring up a bash terminal
2. Archive the /var/opt/carbonblack/psc/ directory:

sudo tar cvf $(hostname --long)_$(date +"%Y-%b-%d_%H-%M-%S")_logs.tgz /var/opt/carbonblack/psc/log

3. Retrieve the file Hostname_YYYY-MMM-DD_HH-MM-SS_logs.tgz
4. Upload the file via Cb Vault (https://community.carbonblack.com/groups/cb-vault) or Smartfile link

Additional Information

For newer sensors, please refer to this KB