CB Response: Unable to install Cb-Event-Forwarder on CentOS 7
search cancel

CB Response: Unable to install Cb-Event-Forwarder on CentOS 7

book

Article ID: 287910

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Unable to install cb-event-forwarder on CentOS 7 with libsasl2.0 package dependency errors

Environment

  • Carbon Black Response Server: 6.2.4 and higher
  • Carbon Black Event Forwarder: All Versions
  • CentOS/RedHat 7

Cause

CentOS 7 has not been qualified with the CB-Event-Forwarder

Resolution

  1. Stand up a CentOS 6 server
  2. Install the CbOpenSource repository
    cd /etc/yum.repos.d
    curl -O https://opensource.carbonblack.com/release/x86_64/CbOpenSource.repo
  3. Install the RPM via YUM:
    yum install cb-event-forwarder
  4. On the CB Response Application Server, log in via SSH/Terminal and run the following command to get the user and password for RabbitMQ
    egrep 'RabbitMQUser|RabbitMQPassword' /etc/cb/cb.conf
  5. On the cb-event-forwarder server, open /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf
  6. Edit the file with the correct information
    rabbit_mq_username=
    rabbit_mq_password=
    cb_server_hostname=
  7. Port 5004 will need to be open for communication
  8. Start the Cb-Event-Forwarder
    initctl start cb-event-forwarder

Additional Information

  • Qualification work is being done in https://jira.carbonblack.local/browse/CB-27749
  • A non-qualified version for Centos/RHEL 7.5 and below can be downloaded and installed from 3.5.0 https://github.com/carbonblack/cb-event-forwarder/releases at your own risk for test environments. This is not supported