Cribl Source & Destination Configuration 4 — Questions and Answers
Question 1: How does Cribl Stream distribute incoming TCP connections across multiple worker processes?
- CPU-usage-weighted distribution
- Sticky sessions per source IP
- Round-robin across worker processes (Correct answer)
- The leader process handles all connections
Correct answer: Round-robin across worker processes
Cribl uses round-robin distribution to spread incoming TCP connections evenly across available worker processes.
Question 2: What certificate format does Cribl require when configuring TLS on a source or destination?
- PKCS#12 (.pfx) only
- PEM-encoded certificates (Correct answer)
- DER binary format only
- Java KeyStore (JKS) only
Correct answer: PEM-encoded certificates
Cribl requires PEM-encoded certificates (typically .pem or .crt files) when enabling TLS on sources or destinations.
Question 3: When a Cribl destination recovers after an outage, what happens to events stored in the Persistent Queue?
- Queued events are dropped since they are now stale
- Cribl automatically replays queued events from the Persistent Queue in order (Correct answer)
- Only new events are sent; queued events expire after timeout
- A manual flush command must be run to replay queued events
Correct answer: Cribl automatically replays queued events from the Persistent Queue in order
When the destination recovers, Cribl automatically replays events stored in the Persistent Queue, ensuring no data is lost during the outage.
Question 4: What is the effect of enabling load balancing across multiple endpoints in a Cribl destination?
- Events are duplicated and sent to all endpoints
- Events are distributed round-robin across the configured endpoints (Correct answer)
- The endpoint with the lowest latency always receives events
- Each pipeline worker sends exclusively to one endpoint
Correct answer: Events are distributed round-robin across the configured endpoints
With load balancing enabled, Cribl distributes events in round-robin fashion across all configured endpoints in the destination.
Question 5: What is the purpose of setting an IP allowlist on a Cribl source?
- Encrypt traffic only from approved senders
- Restrict which source IP addresses or CIDR ranges can send data to the source (Correct answer)
- Prioritize events from trusted IPs
- Set per-IP rate limits
Correct answer: Restrict which source IP addresses or CIDR ranges can send data to the source
An IP allowlist on a source limits connections to only the specified IP addresses or CIDR ranges, rejecting all other clients.
Question 6: When multiple authentication tokens are configured on a single Cribl HTTP source, what is the primary benefit?
- Improved encryption strength through key rotation
- Different clients can authenticate independently while sending to the same source endpoint (Correct answer)
- Automatic token expiration and renewal
- Increased throughput by parallel authentication
Correct answer: Different clients can authenticate independently while sending to the same source endpoint
Multiple tokens allow different client applications or teams to authenticate with separate credentials while all sending data to the same HTTP source.
Question 7: Which configuration setting controls how long a Cribl TCP source waits before closing an idle connection with no data activity?
- Connection timeout
- Idle timeout (Correct answer)
- Keep-alive interval
- Socket read timeout
Correct answer: Idle timeout
The idle timeout setting determines how long an inactive TCP connection is held open before Cribl closes it to free resources.
Cribl Source & Destination Configuration 4
How does Cribl Stream distribute incoming TCP connections across multiple worker processes?