How to Verify a Feed is Syncing

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to check that a feed is syncing with the 3rd Party and Alliance updates

Environment

• EDR (Formerly CB Response) Server: 6.x and Higher
• Linux OS: All Supported Versions

Resolution

To manually sync and view the sync status, run the following on the master server

/usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --master -vvv feed_sync

Additional Information

• To see the last time a feed was actually updated

sudo psql cb -p 5002 -c "select name,update_timestamp from alliance_feeds order by update_timestamp"

• The -vvv is what bumps the logging verbosity up which lists the feed synchronization 
• To add the verbosity long term, edit /etc/cb/cron/cb.cron.template. Increasing the logging levels on a cron job will result in much larger log files and should not be done unless actively troubleshooting feed sync issues. 
  • Change 

{{feed_sync_minute}} 0-1,3-23 * * * {{cb_user}} /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --max-startup-delay 1 --master -s feed_sync >> /var/log/cb/job-runner/startup.out 2>&1

• To 

{{feed_sync_minute}} 0-1,3-23 * * * {{cb_user}} /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --max-startup-delay 1 --master -vvv -s feed_sync >> /var/log/cb/job-runner/startup.out 2>&1