EDR: How to translate failure code in /var/log/cb/sensor_comm_failures/sensor_comm_failures.log?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to translate failure code in /var/log/cb/sensor_comm_failures/sensor_comm_failures.log?

Environment

• EDR Sensor: All Supported Versions

Resolution

• Convert these decimal codes to hexadecimal code. 

For example, -2147012889 is "80072EE7".

• Then add the prefix '0x'.

Adding '0x' to 80072EE7. So it's 0x80072EE7.

• Find the explanation in either of the following ways:

https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-What-are-the-common-sensor-communication-error/ta-p/72454
Or
https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-How-to-Translate-the-CB-Sensor-Communication-Error/ta-p/72455

-2147012894 -> 0x80072EE2: The request has timed out
-2147012889 -> 0x80072EE7: Unknown error
-2147024579 -> 0x8007013D: Failing to copy large files