These docs are for Cribl Edge 4.7 and are no longer actively maintained.

See the latest version (4.13).

Installing Cribl Edge on Linux

You can install Cribl Edge in a supported Linux environment either as a single instance, alongside Cribl Stream, or in multiple instances on one host.

Minimum Requirements

​

The following requirements are the minimum for installing and running an Edge Node on Linux.

Edge Node sizing depends on specific workload requirements and organizational constraints. For more detailed information about requirements for complex deployments, see Deployment Planning.

Download and Install

​

First, download the install package, which is the same binary as Cribl Stream, to your Linux machine.

Next, ensure that required ports are available (see Network Ports).

Then, you can install and run any of the following:

• Single Cribl Edge instance.
• Cribl Edge and Cribl Stream on the same host.
• Multiple installations of the same product, on the same host.

Single Cribl Edge Instance

​

These instructions explain how to run Cribl Edge locally, as a single-instance deployment on your own machine.

Un-tar the install package in a directory of choice, and rename the resulting cribl directory as cribl-edge, e.g.:

cd /opt/ 
tar xvzf cribl-<version>-<build>-<arch>.tgz
mv /opt/cribl/ /opt/cribl-edge

Set the renamed directory, (e.g., /opt/cribl-edge/), as your $CRIBL_HOME directory.

To make the $CRIBL_HOME env variable available on your command line, you can:

• Assign it once, using the export command:
  export CRIBL_HOME=/opt/cribl-edge
• Set it as a default, by adding it to your to your terminal profile file.

Next, navigate to $CRIBL_HOME/bin. Here, you can use ./cribl commands to:

• Set to Edge mode: ./cribl mode-edge
• Start: ./cribl start
• Stop: ./cribl stop
• Reload: ./cribl reload
• Restart: ./cribl restart
• Get status: ./cribl status

You can change the hostname and port, by adding -H (address) and p (port options). E.g:
./cribl mode-edge -H 0.0.0.0 -p 8123

Next, go to http://localhost:9420 and log in with default credentials (admin:admin). You can now start configuring Cribl Edge with Sources and Destinations, or start creating Routes and Pipelines.

Cribl Edge and Cribl Stream on the Same Host

​

You can run an Edge Node with a Leader that is managing Cribl Stream, or an Edge Node and a Stream Worker Node on the same host. To accommodate these scenarios, each product has a distinct service name:

• cribl-edge.service for Cribl Edge.
• cribl.service for Cribl Stream.

Here, Cribl recommends un-tarring the download package twice, into two separate directories. This setup frees you to update and run each product individually. You could choose, e.g., /opt/cribl-edge and /opt/cribl:

cd /opt
tar zxvf /tmp/cribl-<version>-<build>-<arch>.tgz
mv cribl cribl-edge
tar zxvf /tmp/cribl-<version>-<build>-<arch>.tgz

The installation and configuration sequence will be the same for each product:

1. Change the ownership for both installations.

   Run Cribl Stream as a non-privileged user:

   chown -R cribl:cribl /opt/cribl

   Copy

   Run Cribl Edge as a non-privileged user:

   chown -R cribl:cribl /opt/cribl-edge

   Copy

Do NOT Run Cribl Edge as Root!

​

To listen on low ports 1-1024, Cribl Edge needs privileged access. You can enable this on systemd by adding this configuration key to your override.conf file:

[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE 

Copy

If you want to add extra capabilities, such as reading certain resources (e.g., /var/log/*), add CAP_DAC_READ_SEARCH in a space-separated format as follows:

[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_DAC_READ_SEARCH

Copy

Alternatively, you can use ACLs to allow Cribl Edge to read files.

For details, see Running Edge as an Unprivileged User.

2. Set the correct mode, and configure each installation as a service. The -H and -p parameters are required.

   For Cribl Edge:

   /opt/cribl-edge/bin/cribl mode-managed-edge -H <leader-hostname-or-IP> -p <port> [options] [args]
   
   /opt/cribl-edge/bin/cribl boot-start enable
   
   sudo systemctl restart cribl-edge.service

   Copy

   If you are setting up Cribl Edge in single-instance mode, make sure to set mode-edge instead of mode‑managed‑edge .

   
   For Cribl Stream:

   /opt/cribl/bin/cribl mode-worker -H <leader-hostname-or-IP> -p <port> [options] [args]
   
   /opt/cribl/bin/cribl boot-start enable
   
   sudo systemctl restart cribl.service

   Copy

Managing IP Addresses

​

By default, Cribl Edge’s API listens on port 9420, instead of on Cribl Stream’s default 9000 port. Some things to note:

• You can set the CRIBL_EDGE environment variable to any value to bind to 0.0.0.0, instead of to the 127.0.0.1 address.
• If you are starting Cribl Edge from the CLI, make sure you set the -H parameter to 0.0.0.0.
• If you connect your Edge Node to a Leader, the Node will automatically update the binding IP address to the one configured in the Leader’s Fleet Settings. For an Edge Node to always listen on all IP addresses, you must update the Leader’s Host value. (In the Leader’s UI, go to Fleet Settings > System > General Settings, and change the Host field to 0.0.0.0.)

Continue with Setting Up Leader and Edge Nodes for Edge, and Setting Up Leader and Worker Nodes for Stream.\

Multiple Installations of Same Product on Same Host

​

There are situations where it makes sense to run multiple Cribl Edge or Cribl Stream installations on the same host. For example, suppose two departments want to collect the data at the edge – and each wants to process the data differently, and to deploy its own Helm chart as a daemonset.

To support this: After un-tarring the installation package, copy or move it into a separate directory for each installation. For example, if you’re creating two Cribl Edge installations:

cd /opt
tar zxvf /tmp/cribl-<version>-<build>-<arch>.tgz
cp -r cribl/ cribl-edge-01/
mv cribl/ cribl-edge-02/

The installation and configuration procedure is the same as described for collocated Cribl Edge and Cribl Stream above, except that you must:

• Omit steps pertaining to the product you are not installing.
• Repeat steps pertaining to the product you are are installing – once for each instance of the product.

Ensure that each instance of the product runs on its own dedicated port. Either:

• Specify different ports when you run the mode-managed-edge or mode-worker command; or,
• On the host, set the CRIBL_AUTO_PORTS environment variable to 1.

Troubleshooting Resources

​

Cribl University’s Troubleshooting Criblet on Switching from Cribl Edge to Cribl Stream demonstrates these techniques for integrating Edge with Stream. To follow the direct course link, first log into your Cribl University account. (To create an account, select the Sign up link. You’ll need to click through a short Terms & Conditions presentation, with chill music, before proceeding to courses – but Cribl’s training is always free of charge.) Once logged in, check out other useful Troubleshooting Criblets and Advanced Troubleshooting short courses.