Collect Carbon Black Cloud Sensor Logs Locally

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How to collect logs and configuration information from the Carbon Black Cloud endpoint when directly accessing the device.

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions
• Apple MacOS: All Supported Versions
• Linux: All Supported Versions

Resolution

Microsoft Windows

1. Open an administrative command prompt
2. Run the commands:

   cd "C:\Program Files\Confer"
   repcli capture <LocalOutputPath>
   -- Example: repcli capture C:\Users\%USERNAME%\Desktop

Linux

1. Launch preferred terminal emulator
2. Run log collect command to output to existing directory:

   sudo /opt/carbonblack/psc/bin/collectdiags.sh --verbose --debug --output-dir <Destination_Directory>

macOS

1. Launch preferred terminal emulator
2. Run log collect command to output to existing directory:

   sudo /Applications/VMware\ Carbon\ Black\ Cloud/repcli.bundle/Contents/MacOS/repcli capture <Uninstall_Code> <Destination_Directory>