EDR: How To Upgrade the CB-Event-Forwarder
search cancel

EDR: How To Upgrade the CB-Event-Forwarder

book

Article ID: 286295

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to upgrade the CB-Event-Forwarder

Environment

  • EDR: All Supported Versions
  • Event Forwarder:  All Supported Versions

Resolution

  1. Backup the existing configuration:
mkdir /root/cb-event-forwarder_bak && cp /etc/cb/integrations/event-forwarder/* /root/cb-event-forwarder_bak/
ls /root/cb-event-forwarder_bak/
  cb-event-forwarder.conf  cb-event-forwarder.conf.bak
  1. Run the command to upgrade:
yum -y update cb-event-forwarder
  1. Restart the CB Event Forwarder service to ensure the changes are pushed through, run the commands based on the OS version:
  • CentOS 6.x
service cb-event-forwarder stop
service cb-event-forwarder start
  • CentOS 7.x/8.x
systemctl stop cb-event-forwarder
systemctl start cb-event-forwarder

Additional Information

If a repo error is faced during the upgrade, the CBOpenSource repo may need to be reinstalled:
https://community.carbonblack.com/t5/Knowledge-Base/EDR-Error-getting-repository-data-for-CbOpenSource-while/ta-p/94292
Powered by Wolken Software