EDR: How to Add Minion Server to an Existing Cluster

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to add a minion server to an existing cluster?

Environment

• EDR Server: All Versions
• Clustered

Resolution

To add minion server to an existing CBCluster:

1. Verify that master and minion are on the same version of Carbon Black EDR
2. Login to the master server and stop the cluster services:

   /usr/share/cb/cbcluster stop

3. Check the status to ensure the cluster services have stopped:

   /usr/share/cb/cbcluster status

4. Run the cluster add node command:

   /usr/share/cb/cbcluster add-node

5. On the master server, start up the cluster:

   /usr/share/cb/cbcluster start

Additional Information

• Reference Pg 55 of Server Cluster Management Guide
• Adding a minion server with faster processing speed will not cause performance issues across the Cluster. However query timing in the Cluster depends on all servers to respond before returning results, therefore query timing across all servers will depend on the speed of the slower processing servers.
• As the load of sensor data starts to distribute between the nodes, it is possible to see some improved query performance when the slower processing servers have less event cores to search