@@ -39,37 +39,59 @@ Otherwise, it is acceptable to install the cb-event-forwarder on the EDR server
3939
4040### Installation
4141
42- To install and configure the cb-event-forwarder, perform these steps as "root" on your target Linux system. NOTE: if you plan
43- to use the EDR console to configure and control cb-event-forwarder, then you MUST install it on the same system on which
44- EDR is installed (in the case of a cluster installer, this means the primary node) .
42+ For customers running Event Forwarder, versions 3.7.5 or older, the following installation instructions will install
43+ Event Forwarder 3.7.6. For those running Event Forwarder versions 3.8.0 or 3.8.1, you will first need to remove that
44+ version of Event Forwarder .
4545
46- 1 . Install the CbOpenSource repository if it isn't already present:
46+ #### Removal of currently installed event
47+
48+ 1 . Stop event forwarder service:
49+
50+ ```
51+ sudo service cb-event-forwarder stop
52+ ```
53+
54+ 2. Remove the current event forwarder package:
55+
56+ ```
57+ sudo yum remove cb-event-forwarder
58+ ```
59+
60+ #### Installation
61+
62+ To install and configure the cb-event-forwarder, perform these steps as "root" on your target Linux system.
63+ NOTE: if you plan to use the EDR console to configure and control cb-event-forwarder, then you MUST install
64+ it on the same system on which EDR is installed (in the case of a cluster installer, this means the primary node).
65+
66+ 1. Install the CbOpenSource repository if it isn't already present:
4767
4868 ```
4969 cd /etc/yum.repos.d
5070 curl -O https://opensource.carbonblack.com/release/x86_64/CbOpenSource.repo
5171 ```
52- 2. Install the RPM via YUM:
72+ 2. Install the RPM via YUM:
73+
74+ ```
75+ yum install cb-event-forwarder-3.7.6
76+ ```
5377
54- ```
55- yum install cb-event-forwarder
56- ```
57- 3. If you are using EDR 7.1.0 or greater and wish to use the EDR console to configure and operate the Event
58- Forwarder, run the following script to set the appropriate permissions needed by EDR:
78+ 3. If you are using EDR 7.1.0 or greater and wish to use the EDR console to configure and operate the Event Forwarder,
79+ run the following script to set the appropriate permissions needed by EDR:
5980
60- ```
61- /usr/share/cb/integrations/event-forwarder/cb-edr-fix-permissions.sh
62- ```
81+ ```
82+ /usr/share/cb/integrations/event-forwarder/cb-edr-fix-permissions.sh
83+ ```
6384
6485### Configure the cb-event-forwarder
6586
66871. If installing on a machine *other than* the EDR server:
6788 1. Create a new RabbitMQ user by executing the following commands as root on the EDR server:
68- ```
69- /usr/share/cb/cbrabbitmqctl add_user <username > <password >
70- /usr/share/cb/cbrabbitmqctl set_user_tags <username > administrator
71- /usr/share/cb/cbrabbitmqctl set_permissions -p / <username > ".* " ".* " ".* "
72- ```
89+
90+ ```
91+ /usr/share/cb/cbrabbitmqctl add_user <username> <password>
92+ /usr/share/cb/cbrabbitmqctl set_user_tags <username> administrator
93+ /usr/share/cb/cbrabbitmqctl set_permissions -p / <username> ".*" ".*" ".*"
94+ ```
7395 2. Set the `rabbit_mq_username` and `rabbit_mq_password` variables in `/etc/cb/integrations/event-forwarder/cb-event-forwarder.conf` to the credentials you used in the preceding step
7496 file. Also fill out the `cb_server_hostname` with the hostname or IP address where the EDR server can be reached.
75972. If the cb-event-forwarder is forwarding events from a EDR cluster, the `cb_server_hostname` should be set
0 commit comments