CB Response: How To Generate A Heap Memory Profile For Event Forwarder Debugging

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to generate a memory profile for Event Forwarder

Environment

• CB Response:  All Supported Versions
• Event Forwarder:  All Supported Versions

Resolution

1. Execute as root on the Event Forwarder system:

curl "http://127.0.0.1:33706/debug/pprof/heap?debug=1" > heap_profile.dmp

2. Upload to alliance if Event Forwarder is running on your Response server (or master in case of a cluster):

/usr/share/cb/cbpost heap_profile.dmp