Carbon Black EDR Unified View rotates log files on a daily basis and stores them for 7 days. The server generates logs from two sources:

  • nginx – Logs basic access and error logs that are stored in /var/log/cb/nginx/access.log and error.log, respectively. The logs contain the basic HTTP requests made to the Carbon Black EDR Unified View server for the API.
  • uvservices (the Carbon Black EDR Unified View service) – Generates and stores the following log files in /var/log/cb/uvservices:

Log file



Captures output that is generated before the logging framework starts up.


Not currently used.


General log file that includes status of pool workers and end-user activity.