This topic describes Carbon Black EDR Windows sensor event loss.
Cause
Events are dropped by the kernel driver due to high activity or component malfunction, which is calculated by the percentage of total kernel events that were dropped.
Impact
Potential impact to data collection.
Severity Scale
| Event loss (%) |
Health score |
Message |
|---|---|---|
| 1 |
-5 |
Elevated event loss |
| 2 |
-10 |
High event loss |
| 5 |
-20 |
Very high event loss |
| 10 |
-50 |
Excessive event loss |
Remediation
Restarting the service should resolve the issue.
