EDR: Event-Forwarder Throws "messages did not fill entire bundle" Error
search cancel

EDR: Event-Forwarder Throws "messages did not fill entire bundle" Error

book

Article ID: 289907

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Error in /var/log/cb/integrations/event-forwarder/cb-event-forwarder.log:
 
"time="2019-10-23 19:07:21" level=error msg="Error processing zip filename EventLog_8391340522618360443--2019-10-23-23-07-21.log: Error in ProcessProtobufBundle: messages did not fill entire bundle; 1224 bytes left""

Environment

  • EDR Server: All versions (formerly CB Response)
  • EDR Event Forwarder: All versions

Cause

The data sent from the sensor has junk data at the end. 

Resolution

This error can be ignored. It will be hidden in the future release.