Cb-Event-Forwarder Using Too Much Memory

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

cb-event-forwarder is taking too much memory.

Environment

• EDR: All versions
• CB Event Forwarder: All versions

Cause

EF (event-forwarder) takes messages off RabbitMQ as fast as possible, then stores them until it can send them or can write them to local disk. Memory usage increases dramatically which indicates that too many messages are stuck in EF. So it could be caused by CPU or disk I/O.

Resolution

1. Make sure EF is up to date.

2.  Add more SPU resources for EF.

• Check how many CPU cores the server can spare.
• Edit /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf.
• Change message_processor_count=4 to message_processor_count=X (X depends on how many CPU cores)
• Restart EF.