RepCLI is a command line tool that superusers can use to locally manage certain macOS sensor functions.
RepCLI is included in macOS sensors beginning with version 3.5.1 on macOS 10.12 and later operating systems. RepCLI is located in /Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS/. A timestamped log of RepCLI invocations is at /Library/Logs/RepCLI.log. RepCLI invocations are also logged to the system log (Console).
To run RepCLI, launch a terminal, and navigate to the RepCLI directory. Run RepCLI commands within this terminal; for example, $ sudo repcli status. You can get help for a particular command by running the Help command and providing the name of that command as an argument. For example: $ sudo repcli help status.
Some commands require user authentication; these are indicated in the following examples as requiring an <uninstall code> as part of the command syntax. Commands should be on a single line.
The following RepCLI commands are available for macOS sensors:
| Command | Description | Example |
|---|---|---|
| bypass | Enables (1) or disables (0) bypass mode. | $ sudo repcli bypass 0 <uninstall code> |
| capture | Generates and zips sensor logs and data. | $ sudo repcli capture <uninstall code> <dir> |
| cloud | Sensor checks in with the Carbon Black Cloud console. | $ sudo repcli cloud hello |
| counters | Displays kernel extension diagnostic counters. | $ sudo repcli counters |
| help | Displays information about RepCLI commands. | $ sudo ./repcli help status |
| manifest | Use to Request, Reset, Refresh manifest | $ sudo repcli request manifest |
| setsensorkext | Toggles the sensor state from SysExt to Kext. | $ sudo repcli setsensorkext <uninstall code> |
| setsensorkextloadoptions | Allows setting kext load options. <option string> is persistent or unloadable. | $ sudo repcli setsensorkextloadoptions <uninstall code> <option string> |
| setsensorsysext | Toggles the sensor agent from Kext to SysExt. | $ sudo repcli setsensorsysext <uninstall code> |
| startCbServices | Loads the sensor driver and repmgr daemon. | $ sudo repcli startCbServices <uninstall code> |
| status | Displays sensor state values such as version, cloud status, queue status, diagnostic status, enforcement status, and recent sensor alarms. | $ sudo repcli status |
| version | Returns the current product version. | $ sudo repcli version |
