Where to find VMware Carbon Black Cloud Sensor logs for Windows Sensor 3.6.X and higher? – Red Canary Support

Issue

Troubleshooting the VMware CBC sensor can be difficult without reviewing the logs. In case the RepCLI commands are not working you will need to manually review the logs.

Environment

VMware Carbon Black Cloud sensor for Windows Endpoints

Resolution

Sensor logs are stored in C:\ProgramData\CarbonBlack\Logs\confer

Depending on how the sensor was installed, there are other locations where sensor logs may be found (the installer log may be named cb-installer-x-x-x.log or will contain "installer" in the filename):

%LocalAppData\Temp

%SystemRoot%\Temp

For installation logs:

Sensor logs

```
Pre 3.6 - C:\Program Files\Confer
```

Post 3.6 - C:\ProgramData\CarbonBlack\Logs

Microsoft Windows Installer Log (msi.log)

```
Pre 3.6 - C:\Program Files\Confer
```

Post 3.6 - C:\ProgramData\CarbonBlack\Logs

Sensor Install Log (confer-temp.log).

```
C:\Users\<user>\AppData\Local\Temp\
```
```
C:\Windows\TEMP\
```
```
C:\Users\All Users\AppData\Local\Temp
```

Reference: https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-Where-can-sensor-logs-be-found-for-sensors/ta-p/113916

Cause

If RepCLI is not working, the commands to collect the diagnostics logs may fail.