Carbon Black provides diagnostic scripts for each supported platform. These make it easy to collect the information most commonly required for troubleshooting.

For sensor versions 6.1.9 and below

Step 1: Navigate to the Carbon Black Directory

Open Terminal and change to the Carbon Black installation directory:

cd /Applications/CarbonBlack/

Step 2: Execute diagnostic script

The script requires elevated permissions to gather certain files.

sudo ./sensordiag.sh

The diagnostic package will be created in the current working directory, named using the following convention:

sensordiag_<Hostname>_<SensorVersion>_<TimeStamp>.zip

For sensor versions 6.2.0 and greater

Step 1: Navigate to the Carbon Black Directory

Open Terminal and run the following:

sudo /Applications/CarbonBlack/sensordiag -type CDE

Optionally, gather logs from a specified date and later:

sudo /Applications/CarbonBlack/sensordiag -type CDE -startdate 2018-06-29

The diagnostic package will be created in the current working directory, named using the following convention:

sensordiag_<Hostname>_<SensorVersion>_<TimeStamp>.zip

(Remote option) Collect diagnostics via Live Response

Open a Live Response session with the endpoint and perform the following:

execfg /Applications/CarbonBlack/sensordiag -type CDE

Then get  the resulting diagnostic package

Final Step

Share the diagnostics with your Incident Handler through the "Share A File" feature within your portal here.

Did this answer your question?