Adhere to these best practices before attempting to remove minions from an existing cluster.
Consult the VMware Carbon Black Operating Environment Requirements (OER) Guide to make sure that the reduced cluster has the capacity to support the total number of endpoints.
- The remaining minions must have enough disk space to contain the full data.
- Calculate the daily usage of the disk per sensor and re-calculate the required disk space to new minions for full retention. For example:
Assume you want to collapse the six-minion cluster that has 40K endpoints down to three minions with 30-day retention. Carbon Black EDR v6.0+ supports this because each minion still has less than the maximum of 18,750 endpoints.
You calculate the current daily disk usage per sensor to be 20MB (dividing total cluster data volume storage by current daily retention and number of endpoints).
The new total storage requires a minimum of 20MB * 40K (endpoints) * 30 (days) = 24 TB (or 8 TB per node).
Add 20-30% to the available disk space on top of the calculated amount to allow for increased sensor activity in the future.
- Additional extra disk space must be provided for desired cold storage in days.
- Calculate the daily usage of the disk per sensor and re-calculate the required disk space to new minions for full retention. For example:
- The primary cluster node must have enough disk space to contain binary files for all removed minions. Binary files typically take less space than events, but should still be taken into account. You can calculate the required extra space on the primary node by logging into Carbon Black EDR, navigating to Server Dashboard in the left navigation bar, and viewing Storage Statistics for the minions. To obtain the maximum additional space required on the primary node, add up the total binary size on the minions that are to be removed.
- To support the sensor load, the remaining minions must have sufficient CPU and memory.
