CB Response: Event Forwarder fails when Kafka broker stops

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Event Forwarder fails when Kafka broker stops

Environment

• Carbon Black Response Server: All Versions
• Carbon Black Event Forwarder: All Versions

Cause

When using the Kafka output, a combination of high memory allocation profile and high sustained throughput is too high for the garbage collection to keep up.

Resolution

Workaround is to only output to a .json file and then use Filebeat to forward the json output to Kafka.

Additional Information

Filebeat includes a Kafka integration: Filebeats-Kafka