Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Important message about Carbon Black Data Retention settings

Important message about Carbon Black Data Retention settings

Version

Affected versions are v5.0 Patch 1 (5.0.0.150416.1350) and v5.0 Patch 2 (5.0.0.150428.1537)

Topic

On each Carbon Black server (including Master and Minion nodes in clustered installations) in the main configuration file /etc/cb/cb.conf, the default configuration sets disk usage thresholds to 30% rather than the intended default of 70%. The impact of this setting is that the installation’s historical data may be purged when the 30% disk space threshold is met resulting in an unexpected amount of historical data to be purged. There are two potential scenarios to review in order to determine if a change is needed in your Carbon Black installation:

Scenario 1 - Unintended default value is being used:

The MaxEventStoreSizeInPercent parameter does not exist in /etc/cb/cb.conf OR it is commented out with a hash mark, for example:

# This parameter configures the threshold that disk usage would trigger clean up as

# percentage of total disk space available to event store. Total disk space available

# to event store is calculated as the sum of current event store size and free disk space

# (default=30%)

# MaxEventStoreSizeInPercent=30

In this scenario, un-comment, or add the parameter on a new line and change the value from 30 to 70:

# This parameter configures the threshold that disk usage would trigger clean up as

# percentage of total disk space available to event store. Total disk space available

# to event store is calculated as the sum of current event store size and free disk space

# (default=30%)

MaxEventStoreSizeInPercent=70

After making the change, save the /etc/cb/cb.conf file. In this scenario if you have a clustered installation, please ensure this change is made to the /etc/cb/cb.conf file on each Carbon Black server including Master and Minion nodes.

Restarting services is NOT required.

Scenario 2 - A custom value is already being used:

The MaxEventStoreSizeInPercent parameter already exists in /etc/cb/cb.conf and it is NOT commented out with a hash mark, for example:

# This parameter configures the threshold that disk usage would trigger clean up as

# percentage of total disk space available to event store. Total disk space available

# to event store is calculated as the sum of current event store size and free disk space

# (default=30%)

MaxEventStoreSizeInPercent=50

In this scenario as a custom value is being used, there is no need for a change. Customers should retain their custom configuration.

Important Note

This particular issue will be fixed in v5.0 Patch 3, which has a target date for end of May.

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎05-15-2015
Views:
758
Contributors