Linux sensor 2.16.1 cbagentd service crashing creating large core files

Products

• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Audit and Remediation
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Workload

Issue/Introduction

The /opt/carbonblack/cbagentd folder has multiple dump files (core.XXXXX) that can fill the local disk when the Carbon Black Cloud Linux sensor 2.16.1 cbagentd service crashes and restarts.

Environment

• Carbon Black Cloud Console: Current Version
• Carbon Black Cloud Linux sensor: 2.16.1 version
• Linux OS: All Supported Versions

Cause

 High rate of events increases the chances of triggering a sensor behavior, which crashes sensor service and produces core dump files, but restarts the sensor service.

Resolution

• 2.17.0 Linux sensor is tentatively scheduled for release in the October/November 2025 timeframe, and will have the fix for this behavior.
• Workaround:
  • Core dump files can be safely removed/deleted and will not affect the performance of the CB Cloud Linux Sensor.
  • Event Reporting Exclusions can be created to reduce the overall event collection by the sensor when the 2.17.0 sensor is released. This is currently not available on 2.16.x and lower Linux sensor versions.