CB Response: Events not forwarding after integrations path change
search cancel

CB Response: Events not forwarding after integrations path change

book

Article ID: 290230

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Events no longer forwarded to SIEM
  • No new event files are generated
  • Server or event-forwarder was restarted around the time forwarding stopped

Environment

  • CB Response Server: All Versions
  • CB Event-Forwarder: 3.x

Cause

The service no longer knows the path to event-forwarder settings

Resolution

  1. Event-forwarder configurations must be moved back to the proper location: /usr/share/cb/integrations/
  2. Start event-forwarder services
    • CentOS 6: initctl start cb-event-forwarder
    • CentOS 7: systemctl start cb-event-forwarder

Additional Information

/var/log/cb/integrations/cb-event-forwarder/event-forwarder.startup.log will show what prevented the services from starting