Carbon Black EDR Server Disk Configuration

Because Carbon Black EDR is a very I/O intensive application, high performance disks and RAID configurations are required. This section provides the recommended disk configuration for each type of disk partition.

• The data disk partition stores the primary data that requires high performance equipment. Carbon Black EDR places its high-volume data in the /var/cb/data directory by default. To keep the default configuration, the data volume should be mounted to this directory.
• For partitions that require 2 TB of storage space or more, at least five solid-state SAS drives in a RAID5 configuration are required.
• For partitions requiring 5 TB or more of storage space, we require two equally sized volumes to alternate in storing and optimizing event partitions. See the VMware Carbon Black EDR Server/Cluster Management Guide.
• We require that the disks are qualified using the Carbon Black EDR Qualifier tool. Please work with Carbon Black staff to qualify the disk and determine that sufficient throughput is available for your deployment size.
• Non-data disk partitions do not require the same I/O and space requirements as the data disks. Therefore, the non-data partitions should have at least one RAID1 partition across two spinning or two SSD disks.