EDR: How To Restart CB-Event-Forwarder

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to restart the CB-Event-Forwarder service.

Environment

• EDR Server: All Versions
• CB-Event-Forwarder: All Versions

Resolution

1. Log onto the command line of the Event Forwarder server.
2. Stop and start the Event Forwarder service:

initctl stop cb-event-forwarder
initctl start cb-event-forwarder

Perform the following steps to restart the CB Event-Forwarder from the console if the EDR Server is 7.2.0 version or greater:

1. Go to EDR web interface.
2. Navigate to "Manage" > "Event-Forwarder" tab
   • 
3. Click the provided button to start and stop the Event Forwarder service.
   • 

Additional Information

In CentOS 6.x service cb-event-forwarder stop/start will start the service