Where Them
Logs AppWTLA-01

CrowdStrike Falcon Sensor

1 log location · Windows

CrowdStrike, Inc.

Where CrowdStrike Falcon Sensor keeps its logs

CrowdStrike Falcon Sensor logs to %ProgramData%\CrowdStrike\Logs\ on Windows.

Paths are printed exactly as CrowdStrike Falcon Sensor writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.

Finding your way around Windows.

How to turn on debug logging for CrowdStrike Falcon Sensor

  1. Windows: In the registry, go to HKEY_LOCAL_MACHINE\SYSTEM\CrowdStrike\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\{16e0423f-7058-48c9-a204-725362b67639}\Default.
  2. Windows: Set the Binary value AFLAGS to 03.
  3. Windows: Reproduce the issue, then in Event Viewer save the System log filtered on source CSAgent as CrowdStrike_<WORKSTATIONNAME>.evtx.
  4. Windows: Set AFLAGS back to 0 afterwards, because verbose logging can hurt performance.
  5. macOS: On older sensors, run sudo sysctl cs.feature=3, and switch it off afterwards with sudo sysctl cs.feature=0.

How to collect CrowdStrike Falcon Sensor logs

  1. Windows: Run CSWinDiag, by hand or with the Real Time Response cswindiag command; it takes 3 to 4 minutes.
  2. Windows: When run through Real Time Response, collect the result from %ProgramFiles%\CrowdStrike\Rtr\PutRun\CSWinDiag*.zip.
  3. Windows: Also save the System event log filtered on source CSAgent.
  4. Windows: For install problems, collect the CrowdStrike sensor install logs from %LOCALAPPDATA%\Temp (user-run installer) or %SYSTEMROOT%\Temp (cloud or auto-update install).
  5. macOS: Run sudo /Applications/Falcon.app/Contents/Resources/falconctl diagnose.
  6. macOS: On older sensors, run sudo /Library/CS/falconctl diagnose, which writes falconctl_diagnose.tgz to /private/tmp.
  7. Linux: Run sudo grep falcon /var/log/messages > /tmp/CrowdStrike/log_messages.txt (use /var/log/syslog where that is the system log).
  8. Linux: Check the sensor state with sudo /opt/CrowdStrike/falconctl -g --rfm-state.