EDR: Check-in Interval for Sensors to Server
search cancel

EDR: Check-in Interval for Sensors to Server

book

Article ID: 285774

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What is the check-in interval for sensors to the EDR server? 

Environment

  • EDR Server: 7.5.0 and Higher

Resolution

Defined in /etc/cb/cb.conf. 
  • SensorCheckinDelaySec=60

Additional Information

  • Default value is 60, setting lower can potentially overwhelm Datagrid, the in memory storage that handles multiple items in the product and communicates with the minions (if clustered)
  • Check-in adjustment does not affect event submission time.
  • Check-in's provide updated sensor vitals such as the last checkin time, event/binary queue, uptime, sensor health status. This information is not critical to have updated earlier than the default setting. 
  • A sensor is considered offline when last checkin time reported is over 5 minutes by default.