EDR Server: How to Diagnose the Event Forwarder Failing to Start

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to Diagnose an Event Forwarder Outage. 

Environment

• EDR Server Server: All Supported Versions
• EDR Event Forwarder: All Supported Versions

Resolution

1. Run the following command:

   /usr/share/cb/integrations/event-forwarder/cb-event-forwarder -check

2. Verify any errors from its output
3. Check for errors in the following logs:

   /var/log/cb/integrations/cb-event-forwarder/startup.log
   /var/log/cb/integrations/cb-event-forwarder/debug.log