EDR Server: Cluster cannot start with newly added node - hazelcast error: "near cache is not initialized"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

After adding a new node, the cluster fails to starts. In the logs hazelcast errors show "near cache is not initialized"

Environment

• EDR Cluster: 7.x and above

Cause

Firewalld is not configured properly so communication is blocked between nodes

Resolution

• Confirm properly configured firewall settings or disable firewall

• Firewall configuration required for EDR can be checked and applied via the cbcheck tool 

  • /usr/share/cb/cbcheck firewall -l  (Lists missing rules)
  • /usr/share/cb/cbcheck firewall -a (Applies missing rules)