EDR: Should 'cb-enterprise' Service be Disabled When CBCluster is restarted.

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Should the 'cb-enterprise' service be started/disabled when the Server or Cluster is restarted?

Environment

• EDR Server: All Versions
• Clustered

Resolution

Yes, by default the 'cb-enterprise' service is disabled from starting when the Server or Cluster is restarted. This ensures 'cb-enterprise' service is started on each node when 'cbcluster -start' command is run on Primary node.

Additional Information

• VMWare Carbon Black does not recommend using an autostart function on CBClusters due to the nature of how the CBCluster starts
• There are dependencies on the Secondary servers which may not be met upon restarting the Cluster. All nodes need to be online and operational before 'cbcluster start' is run
• Only in a standalone environment should the 'cb-enterprise' service be started/enabled when the Server is restarted
• Following Feature Request has been created requesting a watchdog service be integrated for monitoring the Cluster services:

https://community.carbonblack.com/t5/Idea-Central/Integrate-watchdog-service-for-CB-Response-EDR-Cluster/idi-p/104240