Cb-Event-Forwarder Stops Sending Event Data With "NOT_FOUND - no exchange 'api.rawsensordata' in vhost'

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Event Forwarder stopped sending event data, in the /var/log/cb/integrations/cb-event-forwarder/cb-event-forwarder.log a message similar to the following is seen. 

level=info msg="AMQP loop 1 exited: Exception (404) Reason: \"NOT_FOUND - no exchange 'api.rawsensordata' in vhost '/'\". Sleeping for 30 seconds then retrying."

Environment

• EDR Server: All Supported Versions
• Cb-Event-Forwarder: All Supported Versions

Cause

RabbitMQ is missing the messaging queue and the event forwarder is unable to subscribe and listen. This may happen after an upgrade of the EDR server. 

Resolution

1. Stop the EDR server services

   Standalone:
   /usr/share/cb/cbservice cb-enterprise stop
   
   Cluster:
   /usr/share/cb/cbcluster stop

2. Stop the cb-event-forwarder services

   systemctl stop cb-event-forwarder

3. Delete the RabbitMQ mnesia files on all server nodes.

   rm -rf /var/cb/data/rabbitmq/mnesia
   rm -f /var/cb/.erlang.cookie

4. Start the EDR server services

   Standalone:
   /usr/share/cb/cbservice cb-enterprise start
   
   Cluster:
   /usr/share/cb/cbcluster start

5. Start the event forwarder services. 

   systemctl start cb-event-forwarder