CB Response: Event Forwarder Fails to Start with "initctl: Job failed to start"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

initctl start cb-event-forwarder fails with the message "initctl: Job failed to start"

Environment

• CB Response Server: All Supported Versions
• CB Response Event Forwarder: All Supported Versions

Cause

This can be caused by a space issue on the server hosting the event forwader. 

Resolution

1. Verify the space issue with the following command

   /usr/share/cb/integrations/event-forwarder/cb-event-forwarder -check

2. Clean up the missing free space
3. Restart the CB Event Forwarder

   initctl start cb-event-forwarder