Installing Cribl Steam in Distributed Deployment — Part 2 of 2

Installing One Worker node Running on Amazon Linux OS

InfoSecNinja
2 min readJun 11, 2024

This is the second part of the blog series about subjected topic. In the previous post, we have already created a leader node.

What is Cribl Stream’s Worker node?

Worker Node — a Cribl Stream instance that runs as a managed Worker. The Leader fully manages the configuration of each Worker Node.

Below is the command wise procedure to commission a node to act as Cribl Stream worker node.

sudo useradd cribl
sudo usermod -aG cribl cribl
cd /tmp
ls -lrt | grep cribl
sudo tar xzvf cribl-4.7.1-b46d574d-linux-x64.tgz -C /opt
sudo chown -R cribl:cribl /opt/cribl
sudo /opt/cribl/bin/cribl boot-start enable -u cribl
sudo systemctl start cribl
sudo su cribl
/opt/cribl/bin/cribl status

With this already done, We will have our Cribl Stream Web UI available.

We sign in there and change our password of the admin account.

At Settings > Global Settings > Distributed Settings > General Settings, select Mode: Managed Worker (managed by Leader).

Next, on the Leader Settings left tab, confirm or enter the required Address (e.g., criblleader.mycompany.com). Customize the optional settings if desired. Then click Save to restart.

We have to put the auth token as its available under the Cribl Leader node.

With this done and provided firewall rules for TCP 9000 and TCP 4200 between the two hosts (Cribl leader and worker nodes) — this worker nodes will report to the Cribl Leader.

This completes the Cribl Stream Worker Nodes Commissioning. With this done, you may not able to login to Cribl Stream worker node UI over the browser, do not worry for it as the only UI access that is needed is of Leader node.

Now post this if you want to install Cribl Edge on server — either an edge install script can be generated from Leader node (need proper connectivity between the candidate host and Cribl CDN, leader node, etc.) or the manual method of installing edge can be used as mentioned here.

--

--

InfoSecNinja

I help enterprises to keep ahead of their adversaries by helping them realize the hidden value of their enterprise data!