IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

EDR: How to Modify the Scheduled Feed Cron Job Routines

EDR: How to Modify the Scheduled Feed Cron Job Routines

Environment

  • EDR Server:  All versions

Objective

How to modify the EDR scheduled feed synchronizations (full and incremental).

Resolution

The EDR scheduled services are purposely staggered in order to run efficiently. 
Warning:   Use caution when modifying the cron job schedules as they may affect other services running.
 
1.  Make a backup copy of the /etc/cb/cron/cb.cron.template file.
2.  Edit the /etc/cb/cron/cb.cron.template file.
3.  Modify the following lines as needed.  (If you need guidance, please open an EDR Support case.) 
# Synchronize alliance feed metadata and report lists against feed sources -- once an hour
{{feed_sync_minute}} 0-1,3-23 * * * {{cb_user}} /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --max-startup-delay 1 --master -s feed_sync >> /var/log/cb/job-runner/startup.out 2>&1

# Force FULL synchronization of alliance feed metadata and report lists against feed sources -- every 24 hours
{{feed_sync_minute}} 2 * * * {{cb_user}} /usr/share/cb/virtualenv/bin/python -m cb.maintenance.job_runner --max-startup-delay 1 --master -s feed_sync --full-sync >> /var/log/cb/job-runner/startup.out 2>&1
4.  Restart the EDR services.

Additional Notes

  • For a non-permanent setting, modify the line to /etc/cron.d/cb.   It will reset to the default after EDR is restarted.
  • Commands intended to be run by cron are first added to the '/etc/cb/cron/cb.cron.template' file.
  • Commands will be passed to the '/etc/crond/cb' file when the Cb Response services are restarted. 
  • View the /etc/cron.d/cb file to translate the template variables.

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎03-20-2024
Views:
72
Contributors