EDR: Can't Remove Read-only Node due to Remaining Binaries

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Receive the following error while running "/usr/share/cb/cbcluster --remove-node"

Cannot remove node X because it still holds 897988 binaries

Environment

• EDR: 6.x and Higher

Cause

Binaries haven't finished being copied to the master.

Resolution

• The best practice is to remove the node days after making the node read-only. So master can copy all the binaries from the minion node.
• If /var/cb/data/modulestore has been cleaned up manually on the minion, please manually run "modulestore_sync" cron job using the following command:

  /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner -s -q modulestore_sync >> /var/log/cb/job-runner/startup.out 2>&1