CB Response: How to create script to automate an unmount of several cores
search cancel

CB Response: How to create script to automate an unmount of several cores

book

Article ID: 284945

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • When it's necessary to unmount several cores at once, this script can offer some suggestions on easing the process.

Environment

  • CB Response Server: All Supported Versions

Resolution

  • Generate a list of current cores:
ls -1 /var/cb/data/solr5/cbevents > cores.txt
  • This should generate the cores.txt file in the current working directory. 
  • Modify this list to only the cores that need unmounted.
  • Once modified, edit the script below :
    • Replacing <API TOKEN> with your API token.  This can be found under 'My Profile' section within the CB Response Console.
    • Replacing 127.0.0.1 with the server address (if applicable)
for core in $(cat cores.txt); do echo 'curl -XPOST -H "X-Auth-Token:<API TOKEN>" "https://127.0.0.1/api/v1/storage/events/'$core'/unmount" -k'| sed -e "s/$/ \&\&/" >> curl_core_unmount.txt ; done && cat curl_core_unmount.txt | sed '$ s/ \&\&//' > unmount_cores.sh
  • Run the previous loop, which will:
    • Output curl_core_unmount.txt
    • Add in conditionals (&&) to proceed to the next subsequent core if the previous command completes successfully
    • The final "&&" needs to be removed so, the last piped command does this to curl_core_unmount.txt creating unmount_cores.sh
  • Allow the script to executed:
chmod +x unmount_cores.sh
  • Run the unmount_cores.sh script
./unmount_cores.sh
 
  • This type of methodology can also be used to remount the cores upon completion, if needed.