In today’s IT and security environments, visibility is everything. Whether you’re running thousands of Cribl Edge agents or dozens of Stream Worker Nodes, knowing the exact state of your infrastructure at any moment is critical, not just for troubleshooting, but for compliance, security, and operational peace of mind.
That’s why we’re excited to release disconnected node tracking, a new feature in Cribl 4.13 for Stream and Edge that gives you full and timely visibility into every node in your environment, even when it’s offline.
The Problem: Incomplete Node Visibility
You’ve got loads of Edge and Worker Nodes in your environment. But what happens when a Stream Worker node goes offline after a network outage? Or when a laptop with a Cribl Edge node disappears from your inventory after it goes offline for a few days?
Previously, the Cribl Leader only displayed actively connected nodes. That meant if a node went offline during a patch, upgrade, or outage, it might disappear — making it tough to know if something was broken or simply inactive.
Disconnected node tracking solves that problem. Now, you can:
See both connected and disconnected nodes in a single view
Filter by connection state: connected or disconnected
Export your full node list (CSV or JSON) for audit, compliance, or CMDB comparisons
View properties of disconnected nodes like hostname, MAC address, IP, and last-seen timestamp
And here is the game changer: Customize how long to keep disconnected nodes by Fleet or Group
Real-World Scenarios Solved
After a network outage, a round of security patching, or a Cribl upgrade, you shouldn’t be left playing a guessing game. With disconnected node tracking, you’ll know exactly which nodes came back online and which ones ghosted you (hey, it happens).
Need to prove you’ve got your house in order? Just export a full inventory for compliance or audit reports. And if a node suddenly drops off the radar, you’ve got everything you need to track it down such as location, specs, time last seen, and more.
How It Works
In Cribl.Cloud, disconnected node tracking is enabled by default for all customer-managed Worker Groups and Edge fleets. The default retention period is 1 day, but you can easily customize it per group or fleet.
In self-hosted deployments, enable the "Persist Nodes" toggle in Global Settings > Limits > Other. Once enabled, the Leader will restart and begin tracking disconnected nodes in the internal inventory. All data is stored in the Leader’s state directory.
Step-by-Step Walkthrough
Let’s walk through how to use the feature. We'll use Cribl Edge for this example, but the steps are nearly identical in Cribl Stream, just the main difference is that you'll find it under the Stream Workers page.
You can start by navigating to the Edge Nodes page. You’ll see a new Connection column indicating whether nodes are connected or disconnected. Two additional columns, Connected At and Disconnected At, show timestamps for the most recent activity, and keep in mind all the columns can be hidden or shown as needed.
You can use the new Connection Status Filter to sort by connected or disconnected nodes.
You can also configure how long after disconnecting the Nodes are tracked in the UI. To configure retention time, go to the Fleets page, select a fleet, and navigate to Fleet Settings > Fleet Configuration, and enter your desired retention period in hours, days, or weeks.
This configuration is especially useful when applying different retention logic to different endpoints. You can set retention to 0 for test or Kubernetes fleets that don’t need long-term tracking. Alternatively, for example, keep it longer for devices like laptops that may go dark over the weekend (because yes, people do take time off), or on the other hand you might want to keep critical infrastructure like domain controllers tracked all the time.
This is just the beginning with future releases including enhancements like alerting on disconnected nodes.
Key Benefits
Full visibility across all Stream and Edge nodes, even when offline
Improved troubleshooting with complete node metadata for disconnected nodes
Faster root cause analysis for Cribl Admins
Security and compliance ready with exportable node data
Easy configurations for customizable retention by Worker Group or Fleet
Get Started
Cribl.Cloud customers: It’s already enabled. Just visit your Edge or Stream settings to customize node retention.
Self-hosted customers: Upgrade to Cribl 4.13, enable the "Persist Nodes" toggle, and configure your retention per Fleet or Group.
Stay in Control—Even When Nodes Go Dark
With disconnected node tracking, you’ll never be left wondering which nodes are active, which are down, or what’s really going on. It’s one more way Cribl helps you gain more control and visibility over your telemetry data.
Try it today—upgrade to 4.13 or log in to Cribl.Cloud now!