This section introduces Carbon Black EDR clusters and explains how to configure clusters, add minions to existing clusters, remove minion nodes from clusters, and upgrade cluster nodes.
A Carbon Black EDR cluster is a group of servers that fulfill certain roles and operate as a single Carbon Black EDR instance. Clusters support a larger number of sensors and data than a single standalone server can support.
Carbon Black EDR collects a large volume of data at varying degrees of velocity. As volume and velocity increase, the server begins to reach the limit of what a single server can support. To support increasing volume and velocity, the infrastructure must grow horizontally. This means adding additional servers to the infrastructure. A cluster of Carbon Black EDR servers must be configured when the desired number of sensors, activity level, or amount of retention exceeds a certain threshold, which negatively impacts the performance of a single Carbon Black EDR server instance.
Horizontal scaling is used by Solr, which is the core component that Carbon Black EDR uses to store data. Solr is a big data solution that uses distributed indexes and distributes queries to those indexes. This increases query performance for high volume and velocity indexing. The Carbon Black EDR infrastructure is modeled around this concept to support optimal scaling performance.
See the Carbon Black EDR Server Operating Environment Requirements Guide for more information onCarbon Black EDR server performance and hardware requirements.
