How to Collect CrowdStrike Falcon Sensor Logs

This article discusses the methods for collecting logs for the CrowdStrike Falcon Sensor.

Affected Products:

• CrowdStrike Falcon Sensor

Affected Operating Systems:

• Windows
• Mac
• Linux

It is highly recommended to collect logs before troubleshooting CrowdStrike Falcon Sensor or contacting Dell support.

Click Windows, Mac, or Linux for relevant logging information.

Windows

CrowdStrike Falcon Sensor can be troubleshot on Windows by manually collecting logs for:

• MSI logs: Used to troubleshoot installation issues.
• Product logs: Used to troubleshoot activation, communication, and behavior issues.

Click the appropriate logging type for more information.

MSI

1. Log in to the affected endpoint.
2. Right-click the Windows start menu and then select Run.
   
3. In the Run user interface (UI), type either:
   • If installed by user: Type the following command and then click OK.

     %LOCALAPPDATA%\Temp

   • If Installed by auto update: Type the following command and then click OK.

     %SYSTEMROOT%\Temp

   
4. Collect:
   • CrowdStrike Window Sensor_<TIMESTAMP>_<BIT>.log
   • CrowdStrike Window Sensor_<TIMESTAMP>.log
   
   Note:

   • <TIMESTAMP> = Date & time of Installation
   • <BIT> = Represents either Agent32 or Agent64

Product

Dell Technologies recommends to Enable verbosity and then reproduce the issue before the Capture of product logs. Once the issue is resolved, Dell Technologies recommends to Disable verbosity. Click the appropriate process for more information.

Enable

1. Log in to the affected endpoint.
2. Right-click the Windows start menu and then select Run.
3. In the Run user interface (UI), type the following command and then press CTRL+SHIFT+ENTER to run the Registry Editor as an administrator.

   regedit

   
4. If User Account Control (UAC) is enabled, click Yes. Otherwise, go to Step 5.
   
5. Go to [HKEY_LOCAL_MACHINE\SYSTEM\CrowdStrike\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\{16e0423f-7058-48c9-a204-725362b67639}\Default].
   
6. Double-click AFLAGS.
   
7. Press Delete, type 03, and then click OK.
   
8. Click File and then select Exit.
   
   Note: Once logging is enabled, reproduce the issue.

Capture

1. Log in to the affected endpoint.
2. Right-click the Windows start menu and then select Run.
    
3. In the Run user interface (UI), type the following command and then click OK.

   eventvwr

   
   
4. In Event Viewer, expand Windows Logs and then click System.
   
5. Right-click the System log and then select Filter Current Log.
   
6. Set the Source to CSAgent.
   
7. Right-click the System log and then select Save Filtered Log File As.
   
8. Change the File Name to CrowdStrike_<WORKSTATIONNAME>.evtx and then click Save.
   
   Note: Dell Technologies recommends specifying the <WORKSTATIONNAME> in case the issue is happening on multiple endpoints.

Disable

1. Log in to the affected endpoint.
2. Right-click the Windows start menu and then select Run.
   
3. In the Run user interface (UI), type the following command and then press CTRL+SHIFT+ENTER to run the Registry Editor as an administrator.

    regedit

   
4. If User Account Control (UAC) is enabled, click Yes. Otherwise go to Step 5.
   
5. Go to [HKEY_LOCAL_MACHINE\SYSTEM\CrowdStrike\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\{16e0423f-7058-48c9-a204-725362b67639}\Default].
   
6. Press Delete, type 0, and then click OK.
   
7. Click File and then select Exit.
   

Mac

CrowdStrike Falcon Sensor can be troubleshot on Mac by collecting:

• Install logs: Used to troubleshoot installation issues.
• Product logs: Used to troubleshoot activation, communication, and behavior issues.

Click the appropriate log type for more information.

Install

CrowdStrike Falcon Sensor uses the native install.log to document install information.

1. From the Apple menu, click Go and then select Go to Folder.
   
2. Type the following command and then click Go.

   /var/log

   
   
3. Copy Install.log to a readily available location for further investigation.
   
   Note: Dell Technologies recommends searching for "CrowdStrike" to ensure that the information is relevant to CrowdStrike.

Product

Dell Technologies recommends to Enable verbosity and then reproduce the issue before the Capture of product logs. Once the issue is resolved, Dell Technologies recommends to Disable verbosity. Click the appropriate process for more information.

Enable

1. Log in to the affected endpoint.
2. In the Apple menu, click Go and then select Utilities.
   
3. Double-click Terminal.
   
4. In Terminal, type the following command and then press Enter.

   sudo sysctl cs.feature=3

5. Populate the password for sudo and then press Enter.
   
6. Confirm cs.feature=3.
   
   Note: Once logging is enabled, reproduce the issue.

Capture

1. Log in to the affected endpoint.
2. In the Apple menu, click Go and then select Utilities.
   
3. Double-click Terminal.
   
4. In Terminal, type the following command and then press Enter.

   sudo /Library/CS/falconctl diagnose

5. Populate the password for sudo, and then press Enter.
   
6. After several minutes, falconctl_diagnose.tgz will be generated in /private/tmp.

Disable

1. Log in to the affected endpoint.
2. In the Apple menu, click Go and then select Utilities.
   
3. Double-click Terminal.
   
4. In Terminal, type the following command and then press Enter.

   sudo sysctl cs.feature=0

5. Populate the password for sudo, and then press Enter.
   
6. Confirm cs.feature=0.
   

Linux

1. Log in to the affected endpoint.
2. Open the Linux Terminal.
   
   Note: The user interface (UI) layout may differ between Linux distributions.
3. In Terminal, type the following command and then press Enter.

   su root

4. Populate the password for sudo, and then press Enter.
   
5. Type the following command and then press Enter.

   sudo mkdir /tmp/CrowdStrike

   
   Note: The example /tmp/CrowdStrike directory can be modified in your environment.
6. Type the following command and then press Enter.

   sudo grep falcon /var/log/messages > /tmp/CrowdStrike/log_messages.txt

7. Type the following command and then press Enter.

   sudo grep falcon /var/log/syslog > /tmp/CrowdStrike/log_syslog.txt

8. Type the following command and then press Enter.

   sudo grep falcon /var/log/rsyslog > /tmp/CrowdStrike/log_rsyslog.txt

9. Type the following command and then press Enter.

   sudo grep falcon /var/log/daemon > /tmp/CrowdStrike/log_daemon.txt

   
   Note: Linux distributions may not have all listed directories.
10. Capture all output files within /tmp/CrowdStrike (Step 5) using SSH.
    
    Note:

    • By default, SSH is disabled on Linux distributions.
    • Once SSH is enabled, third-party software (such as PuTTY) can be used to connect to the Linux endpoint.