RepCLI is a command line tool that superusers can use to locally manage certain macOS sensor functions.

RepCLI is included in macOS sensors beginning with version 3.5.1 on macOS 10.12 and later operating systems. RepCLI is located in /Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS/. A timestamped log of RepCLI invocations is at /Library/Logs/RepCLI.log. RepCLI invocations are also logged to the system log (Console).

To run RepCLI, launch a terminal, and navigate to the RepCLI directory. Run RepCLI commands within this terminal; for example, $ sudo repcli status. You can get help for a particular command by running the Help command and providing the name of that command as an argument. For example: $ sudo repcli help status.

Some commands require user authentication; these are indicated in the following examples as requiring an <uninstall code> as part of the command syntax. Commands should be on a single line.

The following RepCLI commands are available for macOS sensors:

Table 1. RepCLI Commands for macOS Sensors
Command Description Example
bypass Enables (1) or disables (0) bypass mode. $ sudo repcli bypass 0 <uninstall code>
capture Generates and zips sensor logs and data. $ sudo repcli capture <uninstall code> <dir>
cloud Sensor checks in with the Carbon Black Cloud console. $ sudo repcli cloud hello
counters Displays kernel extension diagnostic counters. $ sudo repcli counters
help Displays information about RepCLI commands. $ sudo ./repcli help status
manifest Use to Request, Reset, Refresh manifest $ sudo repcli request manifest
setsensorkext Toggles the sensor state from SysExt to Kext. $ sudo repcli setsensorkext <uninstall code>
setsensorkextloadoptions Allows setting kext load options. <option string> is persistent or unloadable. $ sudo repcli setsensorkextloadoptions <uninstall code> <option string>
setsensorsysext Toggles the sensor agent from Kext to SysExt. $ sudo repcli setsensorsysext <uninstall code>
startCbServices Loads the sensor driver and repmgr daemon. $ sudo repcli startCbServices <uninstall code>
status Displays sensor state values such as version, cloud status, queue status, diagnostic status, enforcement status, and recent sensor alarms. $ sudo repcli status
version Returns the current product version. $ sudo repcli version