EDR: How To Upgrade the CB-Event-Forwarder

[#1]

Environment

• EDR: All Supported Versions
• Event Forwarder:  All Supported Versions

Objective

How to upgrade the CB-Event-Forwarder

Resolution

1. Backup the existing configuration:

mkdir /root/cb-event-forwarder_bak && cp /etc/cb/integrations/event-forwarder/* /root/cb-event-forwarder_bak/
ls /root/cb-event-forwarder_bak/
  cb-event-forwarder.conf  cb-event-forwarder.conf.bak

2. Run the command to upgrade:

yum -y update cb-event-forwarder

3. Restart the CB Event Forwarder service to ensure the changes are pushed through, run the commands based on the OS version:

• CentOS 6.x

service cb-event-forwarder stop
service cb-event-forwarder start

• CentOS 7.x/8.x

systemctl stop cb-event-forwarder
systemctl start cb-event-forwarder

Additional Notes

If a repo error is faced during the upgrade, the CBOpenSource repo may need to be reinstalled:
EDR : Error getting repository data for CbOpenSource while upgrading Event Forwarder

Related Content

GitHub - carbonblack/cb-event-forwarder: Subscribe to raw VMware Carbon Black EDR event feed and for...
EDR: How to confirm the Cb-Event-Forwarder is sending events
EDR: How To Restart CB-Event-Forwarder
EDR : Error getting repository data for CbOpenSource while upgrading Event Forwarder