EDR: DatastoreBroadcastEventTypes= is no longer in the cb.conf file

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

 DatastoreBroadcastEventTypes=* missing in cb.conf after upgrading to 7.3.0 and higher

Environment

• EDR Server: Version 7.3.0 and higher

Cause

DatastoreBroadcastEventTypes= was depreciated due to performance issues it can cause. The raw_sensor_exchange was created to improve handling raw sensor data by compressing it on the RabbitMQ messaging bus

Resolution

• Remove the deprecated setting "DatastoreBroadcastEventTypes=*" in /etc/cb/cb.conf using CLI text editor of choice.
• Add the following new setting into /etc/cb/cb.conf, if not already enabled: 

  EnableRawSensorDataBroadcast=True

Additional Information

• Note: If both EnableRawSensorDataBroadcast=true and DatastoreBroadcastEventTypes are set, this caused double the work on RabbitMQ
• Only one should be set and it should be EnableRawSensorDataBroadcast=true
• For a cluster, this config change should be applied across all nodes of the cluster
• If the EDR Event Forwarder is being used, the following additional configurations will need to be enabled in /etc/cb/integrations/event-forwarder/cb_event_forwarder.conf, followed by a restart of the cb-enterprise services: 

  use_raw_sensor_exchange=true
  events_raw_sensor=ALL