There are two ways to download the latest version of CSWinDiag, version 1.4 as of October 26, 2020: CSWinDiag gathers information about the state of the Windows host as well as log files and packages them up into an archive file which you can send to CS Support, in either an open case (view CASES from the menu in the Support Portal), or by opening a new case. The second option for collecting diagnostic logs from your Windows Endpoint is as follows :Ĭrowdstrike Support will often ask for a CSWinDiag collection on your Windows host when having an issue with the Falcon sensor. Open a command prompt and run the following command to disable logging: Once finished, the path to the file will be displayed in your terminal session, and a Finder window will appear, displaying the directory /private/tmp/ and the sysdiagnose file there will look similar to this: falconctl_diagnose_4APo7TWJ.tgzĪttach the this file that appears in /private/tmp/ to your Support case.Ĭollecting Diagnostic logs from your Windows Endpoint: This process can take 10 minutes to complete. You will get a status bar in the terminal while the diagnostic is performed. To use it, you'll need sudo access on the Mac host, and from a terminal, simply enter the command:įalcon Sensor for Mac 6.11 and above: sudo /Applications/Falcon.app/Contents/Resources/falconctl diagnoseįalcon Sensor for Mac 5.41 and below: sudo /Library/CS/falconctl diagnose

The Falcon Sensor for Mac has a built-in diagnostic tool, and its functionality includes generating a sysdiagnose output that you can then supply to Support when investigating sensor issues. How do I collect diagnostic logs for my Mac or Windows Endpoints? EnvironmentĬollecting Diagnostic logs from your Mac Endpoint:

Crowdstrike for mac download