CB Response: Event Forwarder fails when Kafka broker stops
book
Article ID: 287982
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Event Forwarder fails when Kafka broker stops
Environment
Carbon Black Response Server: All Versions
Carbon Black Event Forwarder: All Versions
Cause
When using the Kafka output, a combination of high memory allocation profile and high sustained throughput is too high for the garbage collection to keep up.
Resolution
Workaround is to only output to a .json file and then use Filebeat to forward the json output to Kafka.