Cribl Edge 101: Collect at the Source

What Cribl Edge is

Per the basic concepts page, Cribl Edge is a vendor-neutral agent for unified telemetry collection. The individual agents you deploy are Edge Nodes, and they live on endpoints such as servers, desktops, laptops, and containers. In a typical deployment, Edge Nodes report to a Leader Node, which handles their configuration and updates.

Edge Nodes are organized in Fleets, groups of nodes that share configuration, follow the same update schedule, and participate in the same data flows. Fleets can have multiple Subfleets that take advantage of configuration inheritance, and configuration (Sources, Destinations, Routes, Pipelines) happens at Fleet level, so the hierarchy manages configuration at scale. Outpost Nodes relay configuration and update communications between the Edge Nodes and the Leader where firewalls get in the way, and Packs import and reuse data flow configurations between Fleets, environments, and deployments.

Data reaches the endpoint through Sources. A Source is a configuration for a specific data category or endpoint type, such as log files or OS-specific metrics, and certain Sources can also receive data from remote senders over protocols such as Syslog or TCP. Collected data is sent to Destinations by QuickConnect, a graphical interface for quickly drag and dropping connections between Sources and Destinations, or by Routes, a more complex mechanism for filtering events to the proper Destinations. Both let you transform, enrich, drop, and modify events by running them through Pipelines containing Functions, and each Route uses one main Pipeline.

Cribl Edge is not designed to ingest large volumes of data from external sources, and it is not intended for collecting data from multiple hosts. The docs point you to Cribl Stream when you need to receive and aggregate data from various endpoints, since Stream is designed to handle high volume workloads by employing multiple Worker processes.

Getting started

The quick start guide shows two ways to get a Cribl Edge running: start with a free Cribl.Cloud instance, or deploy the Cribl Edge agent on a physical or virtual machine. Both begin by making sure your hosts meet the system requirements listed for Linux, Windows, and macOS.

A Leader Node can reside in a free Cribl.Cloud account, which gives you a ready-to-use Cribl Leader that includes Cribl Edge functionality. You sign up for Cribl.Cloud, create an Organization, optionally giving it a friendly alias for the ID that Cribl assigns, and select the AWS Region for your Leader.

Once you have a Leader, you add Edge Nodes. From the top nav, select Manage > Edge Nodes, click Add/Update Edge Node, and select Linux > Add, then run the resulting script on the target endpoint's command line. Windows, Docker, and Kubernetes nodes have their own bootstrap scripts. In a standalone Single-instance deployment, start, stop, and verify the server with the ./cribl start, ./cribl stop, and ./cribl status commands, then open http://127.0.0.1:9420 and log in with the default credentials (admin, admin).

The guide's installation tabs also cover macOS, and on Linux you should install and run Edge as the same user to avoid permissions errors.

Installing on Linux

The Linux installation page starts with minimum requirements: any common Linux distribution with a 64-bit kernel >= 3.10 and glibc >= 2.17, plus OpenSSL >= 3.0 if FIPS mode is enabled. The application minimums are a ~1 Ghz processor, 1024 MB RAM, and 5 GB of free disk space per volume. The install package is the same binary as the Cribl Stream download, and confirm the required ports are available before installing.

cd /opt/
tar xvzf cribl-<version>-<build>-<arch>.tgz
mv /opt/cribl/ /opt/cribl-edge

The package untars into a cribl subdirectory, which you rename to cribl-edge. Set that as your $CRIBL_HOME, change ownership so the service runs as a non-privileged user, and start it:

chown -R cribl:cribl /opt/cribl-edge
/opt/cribl-edge/bin/cribl start

To connect the Node to a Leader, prepare a provisioning token on the Leader first, then set the installation to managed mode:

/opt/cribl-edge/bin/cribl mode-managed-edge -H <leader-hostname-or-IP> -p <port> -u <authToken> [-g <fleet>]

The new Node is assigned to a Fleet on the Leader, either default_fleet or another one according to Fleet mappings, which override the Fleet you pass with -g. For a Single-instance deployment, use mode-edge instead, and you do not need a Leader token. Configure the service so it starts on boot:

/opt/cribl-edge/bin/cribl boot-start enable -m systemd -u cribl
sudo systemctl restart cribl-edge.service

After that, open http://localhost:9420, log in with the default credentials (admin:admin), and configure Sources, Destinations, Routes, and Pipelines. The page also covers running Cribl Edge alongside Cribl Stream on the same host, in two separate directories with distinct service names (cribl-edge.service and cribl.service), and running multiple instances of the same product on one host, each on a dedicated port.

Installing on Windows

The Windows installation page supports Windows 10 and 11 on laptops, desktops, and workstations, and Windows Server 2016, 2019, 2022, and 2025. The application minimums match Linux: a ~1 Ghz processor, 1024 MB RAM, and 5 GB of free disk space per volume.

Before installing, set a compatible browser as your default (Microsoft Edge, Firefox, or Chrome; Internet Explorer is not supported), make the required ports available, prepare an authentication token on the Leader, and grab the installer: on the Cribl Download page, set the Software drop-down to Cribl Edge for Windows and click Download Now for the .msi. For a Cribl.Cloud Leader, the bootstrap flow lists the Leader Port field as 4200.

Install via the interactive Setup Wizard or from a command prompt; either way Cribl Edge is installed as a Windows service, which enables it to automatically restart whenever the Windows Server reboots. In the wizard the default destination is C:\Program Files\Cribl, it offers to keep an existing instance.yml configuration, and you choose a Managed or Single-instance deployment. In Managed mode you enter the Leader hostname or IP address, port, and auth token, and you select Enable TLS for secure connections to the Leader, including Cribl.Cloud. The service runs under the Local System Account by default, or under a Username and Password you supply.

For a silent install from the command line, the page gives this command:

msiexec /qn /i cribl-<version>-<build>-<arch>.msi MODE=mode-managed-edge HOSTNAME=<hostName> PORT=4200 AUTH=<authToken> FLEET=<fleet>

The MSI properties customize the install: TLS is enabled by default; SETENVVARS defines pipe-delimited KEY=VALUE pairs that take precedence over existing service environment variables, the page's example setting HTTP and HTTPS proxy settings; VOLUMEDIR moves the runtime data out of the default C:\ProgramData\Cribl; KEEPDATA=1 preserves configuration, state, and logs across an uninstall and reinstall; and TAGS assigns comma-delimited tags. With no parameters at all, the install lands as a Single-instance deployment: open http://localhost:9420 and log in with the default credentials (admin:admin).

For bulk installs, use the bootstrap script: on the Leader, open the Edge Nodes page, select Add/Update Edge Node, pick Windows > Add or Update, fill out the fields (the script updates in real-time), and paste the result into the target machine's command prompt.

What the docs flag

The docs flag several caveats worth knowing before you deploy.

• Do not run Edge as root on Linux. For low ports 1-1024, add AmbientCapabilities=CAP_NET_BIND_SERVICE to your systemd override.conf, or use ACLs for file access. Keep the installation directory and all its subdirectories on the same device, with external stores such as lookups or Persistent Queues in a separate directory outside it.
• Windows 10 and 11 have suspend-related quirks. After a workstation resumes from sleep or suspend, data still in local network buffers may be lost from TCP Destinations, events may be partially broken, and HTTP Destinations may contain duplicate events.
• Endpoint security software can block the install. Tools such as Windows Defender may block the cribl process, so you may need to add exceptions. The nssm.exe wrapper, which lets Windows Service Manager manage cribl.exe, is a legitimate and essential component of Cribl Edge even though some antivirus software might flag it.
• Changing settings after a Windows install resets them. Running mode-managed-edge later resets all the related options, so even a one-option change requires values for all the other arguments.
• Upgrades from old MSIs carry a caveat. MSIs older than 4.3.0 install Edge so it belongs to the user who ran the installer, and upgrading later as a different user can mix old and new package contents on disk; the docs recommend adding ALLUSERS=1 to the msiexec command for testing.

Frequently asked questions

What is Cribl Edge?

Cribl Edge is a vendor-neutral agent for unified telemetry collection. You deploy it as Edge Nodes on endpoints such as servers, desktops, and containers, and in a typical deployment the nodes report to a Leader Node that handles their configuration and updates.

What are the minimum requirements for a Cribl Edge Node on Linux?

A Linux Edge Node needs a common Linux distribution with a 64-bit kernel >= 3.10 and glibc >= 2.17, plus OpenSSL >= 3.0 if FIPS mode is enabled. The application minimums are a ~1 Ghz processor, 1024 MB RAM, and 5 GB of free disk space per volume.

How do I script Cribl Edge installs on Windows?

Two routes work for bulk installs. Generate a bootstrap script on the Leader (Edge Nodes page, Add/Update Edge Node, Windows > Add) and paste it into each target's command prompt, or run a silent msiexec command carrying the MODE, HOSTNAME, PORT, AUTH, and FLEET parameters.

Can I use Cribl Edge to aggregate logs from many hosts?

No, Cribl Edge is not intended for collecting data from multiple hosts and is not designed to ingest large volumes of data from external sources. The docs point you to Cribl Stream for that role.