EDR: Delay in Event Forwarder Events to the SIEM
book
Article ID: 288027
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Delay in events coming from the event forwarder to the SIEM
Other symptoms include High Memory usage
Environment
- EDR: All Versions
- Cb-Event-Forwarder: 3.6.2 and lower
Cause
Compression is backing up the queue due to too many events
Resolution
Upgrade cb-event-forwarder to 3.6.3 or higher
Additional Information
- 3.6.3 has a new compression algortithm that is able to better handle high volume environments.
- The delay comes from the compression of the events before they get out, a queue grows over time and usually examplifies high memory usuage
Feedback
thumb_up
Yes
thumb_down
No