EDR: How to Modify the Scheduled Feed Cron Job Routines

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to modify the EDR scheduled feed synchronizations (full and incremental).

Environment

• EDR Server:  All versions

Resolution

The EDR scheduled services are purposely staggered in order to run efficiently. 
Warning:   Use caution when modifying the cron job schedules as they may affect other services running.
 

1.  Make a backup copy of the /etc/cb/cron/cb.cron.template file.
2.  Edit the /etc/cb/cron/cb.cron.template file.
3.  Modify the following lines as needed.  (If you need guidance, please open an EDR Support case.) 

# Synchronize alliance feed metadata and report lists against feed sources -- once an hour
{{feed_sync_minute}} 0-1,3-23 * * * {{cb_user}} /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --max-startup-delay 1 --master -s feed_sync >> /var/log/cb/job-runner/startup.out 2>&1

# Force FULL synchronization of alliance feed metadata and report lists against feed sources -- every 24 hours
{{feed_sync_minute}} 2 * * * {{cb_user}} /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --max-startup-delay 1 --master -s feed_sync --full-sync >> /var/log/cb/job-runner/startup.out 2>&1

4.  Restart the EDR services.

Additional Information

• For a non-permanent setting, modify the line to /etc/cron.d/cb.   It will reset to the default after EDR is restarted.
• Commands intended to be run by cron are first added to the '/etc/cb/cron/cb.cron.template' file.
• Commands will be passed to the '/etc/crond/cb' file when the Cb Response services are restarted. 
• View the /etc/cron.d/cb file to translate the template variables.