Cribl Architecture & Components 2 — Questions and Answers
Question 1: In a Cribl Stream distributed deployment, which node type manages Worker node configuration and orchestrates the cluster?
- Worker node
- Collector node
- Leader node (Correct answer)
- Edge node
Correct answer: Leader node
The Leader node holds the authoritative configuration and pushes it to Worker nodes, while Workers handle actual data processing.
Question 2: What is a Cribl Stream 'Worker Group'?
- A logical grouping of Worker nodes that share the same configuration and routes (Correct answer)
- A set of pipelines that process a specific data type together
- A collection of administrators with write access to a deployment
- A cluster of Leader nodes configured for high availability
Correct answer: A logical grouping of Worker nodes that share the same configuration and routes
Worker Groups allow administrators to apply a consistent set of sources, routes, pipelines, and destinations to multiple Worker nodes simultaneously.
Question 3: If a Cribl Stream Leader node becomes temporarily unavailable in a distributed deployment, what happens to Worker nodes?
- Worker nodes immediately stop accepting new data
- Worker nodes continue processing data using their last known cached configuration (Correct answer)
- Worker nodes automatically elect a new Leader via Raft consensus
- All in-flight events are queued in Cribl Lake until the Leader recovers
Correct answer: Worker nodes continue processing data using their last known cached configuration
Worker nodes cache their configuration locally and continue processing data independently, making the data plane resilient to control-plane outages.
Question 4: Which of the following best describes Cribl.Cloud?
- An on-premises appliance for running Cribl Stream in air-gapped environments
- A Kubernetes operator for self-managed Cribl deployments
- A CLI tool for managing Cribl configurations via GitOps pipelines
- A fully managed SaaS offering where Cribl operates the Leader node infrastructure (Correct answer)
Correct answer: A fully managed SaaS offering where Cribl operates the Leader node infrastructure
Cribl.Cloud provides a managed control plane so organizations can use Cribl Stream without managing Leader infrastructure themselves.
Question 5: What is the primary purpose of Persistent Queues in Cribl Stream?
- To permanently archive raw events for compliance and audit retention
- To cache lookup table data on Worker nodes for faster enrichment
- To buffer events locally on a Worker when a destination becomes unavailable, preventing data loss (Correct answer)
- To queue configuration changes before they are applied to the cluster
Correct answer: To buffer events locally on a Worker when a destination becomes unavailable, preventing data loss
Persistent Queues provide a disk-based buffer that absorbs backpressure and prevents event loss when downstream destinations are slow or unavailable.
Question 6: In Cribl Stream, which component is responsible for deciding which pipeline an incoming event is processed by?
- The Source connector
- The Router (Routes) (Correct answer)
- The Destination connector
- The Worker Group configuration
Correct answer: The Router (Routes)
Routes evaluate filter conditions on incoming events and direct them to the appropriate pipeline, acting as the traffic director between Sources and Pipelines.
Question 7: What does the 'commit and deploy' workflow in Cribl Stream represent?
- Saving a configuration change and pushing it to all Worker nodes in the group (Correct answer)
- Committing code to GitHub and triggering a CI/CD pipeline deployment
- Finalizing a pipeline build and exporting it as a container image
- Approving a route change and archiving the previous version to Cribl Lake
Correct answer: Saving a configuration change and pushing it to all Worker nodes in the group
In Cribl's GitOps model, 'commit' saves the change to version history and 'deploy' pushes the active configuration to all Worker nodes in the group.
Cribl Architecture & Components 2
In a Cribl Stream distributed deployment, which node type manages Worker node configuration and orchestrates the cluster?