Use the following methods to verify macOS sensor installations.

The following is a list of key files that should be present if the macOS sensor installation is successful:

Table 1. Key Files
Path Description

6.2.7-osx and earlier:

/Applications/CarbonBlack/CbOsxSensorService

6.3.0-osx and later:

/Applications/Vmware Carbon Black EDR/Contents/MacOS/CbOsxSensorService

 Sensor service

6.2.7-osx and earlier: /Applications/CarbonBlack/sensoruninst.sh

6.3.0-osx and later:

/Applications/Vmware Carbon Black EDR/Contents/Resources/sensoruninst.sh

 Uninstall script

All sensor versions on macOS 10.x

/System/Library/Extensions/CbOsxSensorNetmon.kext

 Network monitor

All sensor versions on macOS 10.x

/System/Library/Extensions/CbOsxSensorProcmon.kext

 Process monitor

7.0.1-mac and later sensor versions on macOS 11.x

Run systemextensionsctl list

Output should contain com.carbonblack.es-loader.es-extension (1.0/1) es-extension [activated enabled]

 User-mode monitor

6.2.6-osx and earlier:

/var/lib/cb/sensorsettings.ini

6.2.7-osx and later:

/var/root/Library/Preferences/com.carbonblack.sensor-service.plist

 Settings file

The installation process can fail if sensorsettings.ini is not located in the same directory as Installer.pkg.

If the installation does not complete successfully, the installer reverts all the changes made to the system but leaves the cblog.log file intact. For troubleshooting, collect the installer log file created at /var/log/cblog.log and send it to Carbon Black for assistance.