CB Response: Event Forwarder fails when Kafka broker stops
search cancel

CB Response: Event Forwarder fails when Kafka broker stops

book

Article ID: 287982

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Event Forwarder fails when Kafka broker stops

Environment

  • Carbon Black Response Server: All Versions
  • Carbon Black Event Forwarder: All Versions

Cause

When using the Kafka output, a combination of high memory allocation profile and high sustained throughput is too high for the garbage collection to keep up.

Resolution

Workaround is to only output to a .json file and then use Filebeat to forward the json output to Kafka.

Additional Information

Filebeat includes a Kafka integration: Filebeats-Kafka