Gaps or Delay in Sensor Events Reaching Console - EventBatchUploadFailure

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Gaps in events coming from the sensor
• Delay in events coming from the sensor
• confer.log shows eventbatchuploadfailures, like:

  WARNING   EventBatchManager::UploadEventBatch: curl(06) http(0) bytes(196608 of 480478) failed to send archive psc_eventbatch_5_timestamp_1733170261_events_1658_size_480478
  INFO      SensorAlarms::AddDeferredAlarm: EventBatchUploadFailure, Failure to send event archive due to network/proxy timeout, err 6 (curl 28) bytesSent 196608 of 480478)

  OR

  WARNING   CCurlWrapper::ProcessResultCommon: handle id: EventsUpload_332, libcurl err: Couldn't resolve host name (6), errbuff: Could not resolve host: dev-prod05.conferdeploy.net
  ERROR     PscMessage::Send: Failed to post PSC message, SI_ERR: 6
  WARNING   EventBatchManager::UploadEventBatch: curl(06) http(0) bytes(00000 of 72437) failed to send archive psc_eventbatch_33_timestamp_1750864538_events_571_size_72437

• Repcli status shows EventBatchUploadFailure alarms, like:

  Alarms:
          EventBatchUploadFailure: 1030 times,  <LastErrorDateandTime>

Environment

• Carbon Black Cloud
• Microsoft Windows: All Supported Versions

Cause

Firewall / Network misconfiguration

Resolution

• Confirm the required "Sensor URL / IP Address" is bypassed in the firewall. See Configuring Carbon Black Cloud Communications.
• Work with your networking team and/or networking vendors to determine root cause