Set Worker Thread Count In The Yara Connector

Products

• Carbon Black EDR

Issue/Introduction

Adjust the CPU usage of the Yara Connector by adjusting the total worker thread count

Environment

• Carbon Black EDR Server: All versions
• Carbon Black EDR Yara Connector

Resolution

1.  Determine number of CPU threads Yara is detecting/utilizing automatically by executing on the worker nodes:

   nproc --all

2. Edit your /etc/cb/integrations/cb-yara-connector/yaraconnector.conf on each worker machine and add this parameter at the bottom where X is the number of worker threads you want to utilize rather than the default and save changes:

   celery_worker_kwargs={"autoscale":"X,X"}

3. Restart cb-yara-connector on all nodes RHEL 7+:

   systemctl restart cb-yara-connector

 

Additional Information

• Increasing beyond the default detected threads is not recommended
• Yara will detect number of cpu cores and set thread count to that value