How to remove or decommission a minion that has gone offline or failed
book
Article ID: 285904
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
There are occasions when a minion crashes or otherwise becomes unavailable. The cluster needs to be reconfigured for the now orphaned sensors of that minion to start to report into the other working minions.
Environment
EDR Server: 6.0.x
Resolution
Stop the cluster from the master with the command:
sudo /usr/share/cb/cbcluster stop
On ALL remaining minions and the master servers, edit /etc/cb/cluster.conf
Modify the [Cluster] section according to the number of servers (including the master). The NodeCount value should be reduced by the number of minions being taken offline. Example: if the NodeCount is 8, and you are removing one minion, reduce the NodeCount value to 7.
Once the cluster is restarted, the orphaned sensors will be re-assigned new nodes to report to. Be aware that the remaining minions that will be absorbing this additional sensor traffic will exhibit an increase the resource usage and may not be properly sized to handle the load.
When the offline minion is restored to working order, you can revert the changes in the cluster.conf and restart the cluster. This will cause the sensors to begin checking into the previously offline minion.