Enable Verbose Debug Logging Locally on Windows Sensor

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to enable verbose user and kernel-mode logging locally via command prompt for EDR Windows sensors.

Environment

• EDR Sensor: 5.x and higher
• Microsoft Windows: All Supported Versions

Resolution

1. Back up the registry prior to enabling logging
2. Locally enable verbose logging:
   • Open a command prompt as administrator
   • Enter the following two commands:

     • reg add HKLM\Software\CarbonBlack\config /v DebugLevel /t REG_DWORD /d 7
       reg add HKLM\Software\CarbonBlack\config /v KernelDebugLevel /t REG_DWORD /d 7
       

   • The registry setting will not take affect until the user-mode sensor service is requested to update:

     • sc control carbonblack 203

3. Reproduce the issue
4. Collect logs.
5. Disable debug logging from the command prompt

   • reg delete HKLM\Software\CarbonBlack\config /v DebugLevel /f
     reg delete HKLM\Software\CarbonBlack\config /v KernelDebugLevel /f
     sc control carbonblack 203

6. If necessary, upload the diagnostics to the tech support case.