CB Response: How to Compress Syslog Data

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to compress Syslog data.

Environment

• CB Response: All Versions
• CB Event Forwarder: All Versions

Resolution

1. Enable the 'compress_data' parameter in the '/etc/cb/integrations/event-forwarder/cb-event-forwarder.conf' file to compress syslog data: 

compress_data=false

 

Additional Information

• A restart of the cb-event-forwarder services is required when making any configuration changes: https://community.carbonblack.com/t5/Knowledge-Base/CB-Response-How-To-Restart-CB-Event-Forwarder/ta-p/80741