EDR: How to Downgrade Event Forwarder
search cancel

EDR: How to Downgrade Event Forwarder

book

Article ID: 287730

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to downgrade Event Forwarder to a previous release.

Environment

  • EDR:  All Versions
  • Event Forwarder: All Versions

Resolution

  1. Backup your /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf for a safe location.  Downgrade will not overwrite this file, this is only for safely.
  2. Stop Event Forwarder
CentOS 6:
service cb-event-forwarder stop

CentOS 7:
systemctl stop cb-event-forwarder
  1.  List all event-forwarder version in the CbOpenSource Yum repo and note the target version string:
yum list --showduplicates cb-event-forwarder

example:
cb-event-forwarder.x86_64     3.7.0-1.el6
  1. Use yum to downgrade to the older version
yum downgrade cb-event-forwarder-<version>.x86_64

example:
yum downgrade cb-event-forwarder-3.7.0-1.el6.x86_6
  1. Confirm downgrade
yum info cb-event-forwarder
  1. Start Event Forwarder
CentOS 6:
service cb-event-forwarder start

CentOS 7:
systemctl start cb-event-forwarder