You can create a log file that provides the Linux sensor communication history.

Procedure

  • Running inside a terminal as root and sending the SIGUSR2 signal (via su), issue this command:
    kill -s12 $(pidof cbdaemon)
    The log is located at /var/tmp/cb/sensor_comms.log. Each transaction has a HRESULT, which can be one of the following:
    Table 1. HRESULT
    Facility Number Description Error Code Value
    204 OS level errors Maps to errno
    25 HTTP ererors HTTP error code
    200 Curl errors See http://curl.haxx.se/libcurl/c/libcurl-errors.html.
    201 Curl form errors
    Note: For sensor version 6.2+, the log location is /var/opt/carbonblack/response/diagnostics. In some sensor versions you might need to run a mkdir /var/opt/carbonblack/response/diagnostics command first.