How to Add Minion Server to an Existing Cluster

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to add a minion server to an existing cluster?

Environment

• Carbon Black EDR Server: All Versions
• Cluster

Resolution

To add minion server to an existing CBCluster:

1. Verify that master and minion are on the same version of Carbon Black EDR
2. Login to the master server and stop the cluster services:

   /usr/share/cb/cbcluster stop

3. Check the status to ensure the cluster services have stopped:

   /usr/share/cb/cbcluster status

4. Run the cluster add node command:

   /usr/share/cb/cbcluster add-node

5. On the master server, start up the cluster:

   /usr/share/cb/cbcluster start

Additional Information

• Reference Server Cluster Management Guide
• Adding a minion server with faster processing speed will not cause performance issues across the Cluster. However query timing in the Cluster depends on all servers to respond before returning results, therefore query timing across all servers will depend on the speed of the slower processing servers.
• As the load of sensor data starts to distribute between the nodes, it is possible to see some improved query performance when the slower processing servers have less event cores to search
• Sensors are automatically distributed to the new node. This is based on an algorithm that utilizes the sensor id and the count of nodes to assign an node id. This is seamless to the user and does not affect event searching. 
• The network will need to be open for communication to the minion node over port 443. Failure to do this will result in sensors showing "online" as they contact the primary node, but will be unable to submit the events.