EDR: DatastoreBroadcastEventTypes= is no longer in the cb.conf file
search cancel

EDR: DatastoreBroadcastEventTypes= is no longer in the cb.conf file

book

Article ID: 284847

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

 DatastoreBroadcastEventTypes=* missing in cb.conf after upgrading to 7.3.0 and higher

Environment

  • EDR Server: Version 7.3.0 and higher

Cause

DatastoreBroadcastEventTypes= was depreciated due to performance issues it can cause. The raw_sensor_exchange was created to improve handling raw sensor data by compressing it on the RabbitMQ messaging bus

Resolution

  • Remove the deprecated setting "DatastoreBroadcastEventTypes=*" in /etc/cb/cb.conf using CLI text editor of choice.
  • Add the following new setting into /etc/cb/cb.conf, if not already enabled: 
    EnableRawSensorDataBroadcast=True

Additional Information

  • Note: If both EnableRawSensorDataBroadcast=true and DatastoreBroadcastEventTypes are set, this caused double the work on RabbitMQ
  • Only one should be set and it should be EnableRawSensorDataBroadcast=true
  • For a cluster, this config change should be applied across all nodes of the cluster
  • If the EDR Event Forwarder is being used, the following additional configurations will need to be enabled in /etc/cb/integrations/event-forwarder/cb_event_forwarder.conf, followed by a restart of the cb-enterprise services: 
    use_raw_sensor_exchange=true
    events_raw_sensor=ALL