Non-persistent sensors not communicating to server with growing backlog

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensors receiving reset messages from server
• Server logs show several 503s in nginx
• Larger than normal backlog

Environment

• EDR Server: All Versions
• EDR Sensor: All Versions
• Non-persistent endpoints

Cause

Non-persistent images were not configured properly for VDI so there are thousands more endpoints checking in at the same time than expected

Resolution

• Golden images of the machines must be reset to have a sensor ID of 0
• If the number of endpoints exceeds OER, additional nodes must be set up in the cluster