EDR: Sensors Queueing Data Despite Checking Into Server

[#1]

Environment

• EDR Server: 7.3.0 and Higher

Symptoms

Aggregate sensor data queue growing and not resolved by the following:

• CB Response: Aggregate sensor event queue is growing too large
• EDR: SOLR writing to drives is suddenly slower causing aggregate sensor backlogs to grow
• EDR: Sensor Backlog Grows Unexpectedly Large
• EDR: Sensor backlog growing with many 503s in Nginx
• EDR: How to vacuum sensor related Postgres tables
• EDR: How to reset Mnesia for RabbitMQ

Cause

Deprecated configuration in /etc/cb/cb.conf that takes away threading to datastore: DatastoreBroadcastEventTypes=*

Resolution

• Remove the deprecated setting "DatastoreBroadcastEventTypes=*" in /etc/cb/cb.conf using CLI text editor of choice.
• Add the following new setting into /etc/cb/cb.conf, if not already enabled: 

  EnableRawSensorDataBroadcast=True

• Restart cb-enterprise services: https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Restart-Server-Services/ta-p/41294

Additional Notes

• For a cluster, this config change should be applied across all nodes of the cluster.
• If the EDR Event Forwarder is being used, the following additional configurations will need to be enabled in /etc/cb/integrations/event-forwarder/cb_event_forwarder.conf, followed by a restart of the cb-enterprise services: 

use_raw_sensor_exchange=true
events_raw_sensor=ALL

Related Content

• CB Response: Aggregate sensor event queue is growing too large
• EDR: SOLR writing to drives is suddenly slower causing aggregate sensor backlogs to grow
• EDR: Sensor Backlog Grows Unexpectedly Large
• EDR: Sensor backlog growing with many 503s in Nginx
• EDR: How to vacuum sensor related Postgres tables
• EDR: How to reset Mnesia for RabbitMQ