EDR: Event-Forwarder Throws "messages did not fill entire bundle" Error
book
Article ID: 289907
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Error in /var/log/cb/integrations/event-forwarder/cb-event-forwarder.log:
"time="2019-10-23 19:07:21" level=error msg="Error processing zip filename EventLog_8391340522618360443--2019-10-23-23-07-21.log: Error in ProcessProtobufBundle: messages did not fill entire bundle; 1224 bytes left""
Environment
EDR Server: All versions (formerly CB Response)
EDR Event Forwarder: All versions
Cause
The data sent from the sensor has junk data at the end.
Resolution
This error can be ignored. It will be hidden in the future release.