CB Response: cb-event-forwarder does not send audit logs

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• CB Event Forwarder appears to be working correctly and sending other logs
• Correct cb.conf and cb-event-forwarder.conf settings are in place

Environment

• CB Response Server: All Versions
• CB Event Forwarder: 3.4.1 and Lower

Cause

Support for audit log forwarding was introduced in CB Event Forwarder 3.4.2.

Resolution

Upgrade to a current version of CB Event Forwarder.