Collect Interoperability Logs for App Control Agent (Windows)

Products

• Carbon Black App Control

Issue/Introduction

Steps to locally collect interoperability logs for the App Control Agent on Windows to identify and troubleshoot software conflicts with third-party applications.

Note: Interoperability logs should be collected when experiencing conflicts where no actual block is happening. If there are actual block events, please refer to Troubleshooting Unexpected Blocks in App Control

Environment

• App Control Windows Agent: All Supported Versions

Resolution

• Note: Troubleshooting cannot take place with the agent uninstalled. Support will need access to a device with the agent installed and experiencing the issue.
  
  Open a case with Carbon Black Support and the provide the following:

  1. Relevant Information:
     • Date/Time interoperability issue occurred (did any change precede the start of it?)
     • Does the vendor of the application have a recommended exclusion list and has it been implemented?
     • Application name experiencing interoperability
     • Any paths/processes known to be associated with the application
     • Are there any blocks seen locally or within the App Control console during the interop issue?
     • Action being performed when interop issue occurs (Expected outcome vs actual outcome)
     • Are results the same if the Agent is stopped and unloaded?
       • Start and Stop The Agent Via Local Command Line / Terminal
  2. Agent Logs:
     1. Open an administrative command prompt and execute the following commands:

        cd "C:\Program Files (x86)\Bit9\Parity Agent"
        dascli password GlobalCLIPassword
        dascli setconfigprop max_rolling_trace_size_mb=0
        dascli resetcounters
        dascli flushlogs
        dascli tamperprotect 0
        dascli debuglevel 6
        dascli kerneltrace 4
        dascli nettrace 1
        
        Important, if Agent 8.10.0+ also issue:
        dascli registerprotected 0

     2. Start a Procmon capture
     3. Reproduce the interop issue
     4. Stop the Procmon capture and save "All Events" as a PML file.
     5. In the administrative command prompt execute the following commands to capture and reduce the logging levels to normal:

        dascli capture "%userprofile%\Desktop\%computername%-Interop.zip"
        dascli password GlobalCLIPassword
        dascli setconfigprop max_rolling_trace_size_mb=50
        dascli debuglevel 0
        dascli kerneltrace 2
        dascli nettrace 0
        
        Important, if Agent 8.10.0+ first issue:
        dascli registerprotected 1
        
        dascli tamperprotect 1

     6. Zip all files and upload them to the case
     7. Once the upload completes, please comment on the support case that the data is available for review (along with all relevant information).

Additional Information