EDR: large number of sensor offline in clustered environment

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Large number of sensor offline
• Server Timestamps are not same on all nodes of the cluster
• Sensor logs shows sensor checking in, but are not online on GUI

Environment

• EDR(Formerly Carbon Black Response) Server: All Supported Versions
• Clustered Server

Cause

Server time was out of sync on some nodes of the cluster.

Resolution

Synchronize Linux time on all nodes.