Installing Cribl Steam in Distributed Deployment — Part 2 of 2

Installing One Worker node Running on Amazon Linux OS

InfoSecNinja
2 min readJun 11, 2024

This is the second part of the blog series about subjected topic. In the previous post, we have already created a leader node.

What is Cribl Stream’s Worker node?

Worker Node — a Cribl Stream instance that runs as a managed Worker. The Leader fully manages the configuration of each Worker Node.

Below is the command wise procedure to commission a node to act as Cribl Stream worker node.

sudo useradd cribl
sudo usermod -aG cribl cribl
cd /tmp
ls -lrt | grep cribl
sudo tar xzvf cribl-4.7.1-b46d574d-linux-x64.tgz -C /opt
sudo chown -R cribl:cribl /opt/cribl
sudo /opt/cribl/bin/cribl boot-start enable -u cribl
sudo systemctl start cribl
sudo su cribl
/opt/cribl/bin/cribl status

With this already done, We will have our Cribl Stream Web UI available.

We sign in there and change our password of the admin account.

At Settings > Global Settings > Distributed Settings > General Settings, select Mode: Managed Worker (managed by Leader).

Next, on the Leader Settings left tab, confirm or enter the required Address (e.g., criblleader.mycompany.com). Customize the optional settings if desired. Then click Save to restart.

We have to put the auth token as its available under the Cribl Leader node.

With this done and provided firewall rules for TCP 9000 and TCP 4200 between the two hosts (Cribl leader and worker nodes) — this worker nodes will report to the Cribl Leader.

This completes the Cribl Stream Worker Nodes Commissioning. With this done, you may not able to login to Cribl Stream worker node UI over the browser, do not worry for it as the only UI access that is needed is of Leader node.

--

--

InfoSecNinja

I help enterprises to keep ahead of their adversaries by helping them realize the hidden value of their enterprise data!