Delay in Sensor Event Observations Reaching Console - EventBatchUploadFailure

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Gaps in events coming from the sensor
• Delay in events coming from the sensor
• confer.log shows eventbatchuploadfailures, like:

  WARNING   EventBatchManager::UploadEventBatch: curl(06) http(0) bytes(196608 of 480478) failed to send archive psc_eventbatch_5_timestamp_1733170261_events_1658_size_480478
  INFO      SensorAlarms::AddDeferredAlarm: EventBatchUploadFailure, Failure to send event archive due to network/proxy timeout, err 6 (curl 28) bytesSent 196608 of 480478)

• Repcli status shows EventBatchUploadFailure alarms, like:

  Alarms:
          EventBatchUploadFailure: 1030 times,  <LastErrorDateandTime>

Environment

• Carbon Black Cloud
• Microsoft Windows: All Supported Versions

Cause

Firewall / Network misconfiguration

Resolution

Confirm the required "Sensor URL / IP Address" is bypassed in the firewall. See Configuring Carbon Black Cloud Communications.