EDR: In a Cluster, When Should the Primary Node Be Eventless?

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

In the EDR cluster environment, when should the Primary server be eventless?

Environment

• EDR Servers:  All versions

Resolution

It depends on the cluster's resources, incoming data and integrations.   Routinely, when the third or fourth minion is introduced to the cluster the Primary node becomes eventless. 

Additional Information

• In small clusters (1-2 minions), the Primary can perform the role of a Solr indexing server (eventful).
• Clusters handling more than 60,000 sensors, or four minions, must have a dedicated Primary node that is not performing minion duties.
• Solr clustering is performed by breaking up a single Solr core into multiple cores called shards.  Shards are evenly distributed to indexing nodes for individual management and distributed querying.