Increase a servers number of datastore threads to help process events faster

Products

• Carbon Black EDR

Issue/Introduction

Increase the speed at which an EDR stand-alone server or minion server can process incoming event data to process large backlogs.

Environment

• Carbon Black EDR Server: 7.x and Higher

Resolution

1. Determine the total number of CPU cores that the server has.  (Example: 40) 
2. Take that number and divide by 4 then add +1.  (Example:   [40/4]+1 = 11 )  - This number represents the standard level that the server should operate at.
3. Log into the stand-alone EDR server or EDR minion.
4. Verify there is CPU and RAM still available. 
5. Modify /etc/cb/cb.conf 

   vi /etc/cb/cb.conf

6. Set DatastoreEventCoreClientThreads to an increased value higher than the value from step 2 above. For example, if the number was 11, then increase the thread count to 16:

   DatastoreEventCoreClientThreads=16

5. Repeat these steps for all minions in the cluster. 
6. Restart the cluster.

Additional Information

• Important: setting this value too high can result in the cluster being overwhelmed and not being able to process any events. 
• Important:  increasing threads will increase CPU and RAM usage, so should only be done if sufficient overhead is available. (ie, don't peg the CPU!) 
• These steps should only be done with the advice of the EDR tech lead or other Senior EDR resource. 
• After the initial backlog is cleared, it's advised to reduce this value back to what it was before.