EDR: Sensor unable to connect to the server due to large payload 0x8019019D

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensor comm log 

https://100.64.4.3:443/sensor/register | 0x8019019d | 19 | 9874 | 0 | 500
Payload Too Large - The request is larger than the server is willing or able to process

• SensorService debug log received following error:

<err> cb.flask.blueprints.sensor_blueprint - [register] Sensor @ 100.64.4.75: payload length 9890 exceeds allowed maximum: 8192
<err> cb.flask.blueprints.sensor_blueprint - RequestEntityTooLarge: 413 Request Entity Too Large: The data value transmitted exceeds the capacity limit.

Environment

• EDR Server: 7.x and Higher

Cause

Sensor unable to connect from a long time. Now resulted in huge set of communication failure logs.
The data value exceeds the limit configured.

Resolution

SensorBlueprintMaxPayload needs to be added to /etc/cb/cb.conf, the value should be greater than the value mentioned in the above error. 
 

Example:
SensorBlueprintMaxPayload=10000