CB Response: Event Forwarder Fails to Start with "initctl: Job failed to start"
search cancel

CB Response: Event Forwarder Fails to Start with "initctl: Job failed to start"

book

Article ID: 285539

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

initctl start cb-event-forwarder fails with the message "initctl: Job failed to start"

Environment

  • CB Response Server: All Supported Versions
  • CB Response Event Forwarder: All Supported Versions

Cause

This can be caused by a space issue on the server hosting the event forwader. 

Resolution

  1. Verify the space issue with the following command
    /usr/share/cb/integrations/event-forwarder/cb-event-forwarder -check
  2. Clean up the missing free space
  3. Restart the CB Event Forwarder
    initctl start cb-event-forwarder