Cb Response: Windows Sensor log error: "HRESULT 0x80072747"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Windows sensor will not check-in to the Cb Response cluster
• Sensor.log file shows errors similar to:

HTTP transaction failed with WinError[0x00002747] HrError[0x80072747]
ReserveEventLog failed HTTPCode[0] HrError[0x80072747]
Unable to push event log 'eventlog_2269497046.673.log.zip' HrError[0x80072747]
Unable to properly synch with server HrError[0x80072747]
Eventlog size threshold reached

 

Environment

• Cb Response: 6.2.3
• Cb Response Windows Sensor: 6.1.6

Cause

• An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full.
• These errors could indicate that some Windows system resources are exhausted. 

Resolution

• Reboot the Windows endpoint to clear up system resources