Moving the Entire /var/cb/data Directory to a New Volume

Products

• Carbon Black EDR

Issue/Introduction

The /var/cb/data filesystem partition is running out of disk space, or there is a requirement to migrate all Carbon Black EDR data and configuration to another volume

Environment

• Carbon Black EDR: All Supported Versions
• OS: Linux (RHEL / CentOS) 

Resolution

1. Format and mount your new disk partition to a new path (e.g., /newvolume/cb/data):

   sudo mkdir -p /newvolume/cb/data
   sudo mount /dev/mapper/your_new_volume /newvolume/cb/data

2. Confirm the partition mounted successfully and check available capacity:

   df -h /newvolume/cb/data

3. To prevent data corruption during the copy process, shut down all services:
4. Use cp -a to copy the contents and permissions of /var/cb/data into the new volume path:

   sudo cp -a /var/cb/data/. /newvolume/cb/data

5. Verify folder sizes and file counts match between source and destination:

   sudo du -sh /var/cb/data
   sudo du -sh /newvolume/cb/data

6. Ensure the cb:cb service account owns the new target directory:

   sudo chown -R cb:cb /newvolume/cb/data
   sudo chmod 755 /newvolume/cb/data

7. Here are two different options to setup EDR to use the new location.
   1. Update the Configuration in /etc/cb/cb.conf to repoint EDR to the new location without symlinks.
      1. sudo grep /var/cb/data /etc/cb/cb.conf (Record configs pointing to /var/cb/data so they can be modifed)
      2. sudo vi /etc/cb/cb.conf (Modify values found in step 1 to point to the new /newvolume/cb/data instead of /var/cb/data)
      3. Start EDR services
   2. This method preserves default file paths in /etc/cb/cb.conf by placing a Linux symbolic link pointing from /var/cb/data to the new location.
      1. Move the original /var/cb/data path as a backup so the new symbolic link can be created

         sudo mv /var/cb/data /var/cb/data.old

      2. Create a symlink pointing /var/cb/data to the new directory:

         sudo ln -s /newvolume/cb/data /var/cb/data

      3. Ensure the symlink is assigned proper ownership:

         sudo chown -h cb:cb /var/cb/data

      4. Start EDR services

Additional Information

• Performance: Ensure the new target volume meets or exceeds the required I/O performance characteristics (e.g., direct-attached SSDs/SAS drives in RAID). NAS or NFS mounts are not supported for /var/cb/data due to high-IOPS demands.
• Downtime: This procedure requires stopping Carbon Black EDR services across the node to ensure database consistency during transfer.