Cb Response: Windows Sensor log error: "HRESULT 0x80072747"

[#1]

Environment

• Cb Response: 6.2.3
• Cb Response Windows Sensor: 6.1.6

Symptoms

• Windows sensor will not check-in to the Cb Response cluster
• Sensor.log file shows errors similar to:

HTTP transaction failed with WinError[0x00002747] HrError[0x80072747]
ReserveEventLog failed HTTPCode[0] HrError[0x80072747]
Unable to push event log 'eventlog_2269497046.673.log.zip' HrError[0x80072747]
Unable to properly synch with server HrError[0x80072747]
Eventlog size threshold reached

 

Cause

• An operation on a socket could not be performed because the system lacked sufficient buffer space or because a queue was full.
• These errors could indicate that some Windows system resources are exhausted. 

Resolution

• Reboot the Windows endpoint to clear up system resources

Related Content

• CB Response: How to Translate the CB Sensor Communication Error Code (HRESULT)
• CB Response: What are the common sensor communication error messages? (HRESULT)
• CB Response: Sensor not checking in behind firewall (0x80cc006e)
• CB Response: Sensors checking in intermittently (0x8007274c)
• CB Response: Sensorcomms.log shows HRESULT error 0x80c80006 for eventlog upload attempts
• CB Response: Sensor logs to collect for general troubleshooting
• https://docs.microsoft.com/en-us/windows/desktop/winsock/windows-sockets-error-codes-2