Carbon Black EDR stores all logged information in the /var/log/cb/ directory.

When you troubleshoot any server-side activity, start with the logs in this directory.