Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

How To Modify the Cb Response Sensor Upgrade Rate

How To Modify the Cb Response Sensor Upgrade Rate

Version

Cb Response 5.x, 6.x

Topic

This document describes how to modify the rate at which sensors are updated when an upgrade is requested (either through group-policy upgrade changes or for global update for OS X/Linux).  Updating too many sensors at once can cause high network utilization and updates are throttled by default, but the rate can be modified to increase or decrease speed of sensor upgrades.

The rate at which sensors (any type) are upgraded is dictated by the following parameters in /etc/cb/cb.conf:

SensorMaxUpgradeRate=600

SensorUpgradeRateMonitorInterval=300

The SensorMaxUpgradeRate determines the maximum number of sensors that will be upgraded per hour.

SensorUpgradeRateMonitorInterval determines the interval length before the next batch of sensors can upgrade. A smaller interval will reduce the number of upgrades at once. By default, the interval is 5 minutes (300 seconds / 60 = 5 minutes).

With default settings, there can be up to 50 upgrades every 5 minutes.

Note: For more information check the cb.conf guide: Carbon Black Response v5.2 - Server Configuration (cb.conf) Guide

Steps

  1. Edit /etc/cb/cb.conf on your Cb Response server and change the values to the desired settings
  2. Restart your Cb Response server or cluster by using:
    1. Server (as root):
      service cb-enterprise restart
    2. Cluster (as root on master)
      /usr/share/cb/cbcluster  stop
      /usr/share/cb/cbcluster start
Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎06-24-2016
Views:
1072
Contributors