How to Manually Roll Solr Cores

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Steps to generate a new writer core, If the writer core is too large.
• Generating a new writer partition with this method forces a Solr core rollover. 

Environment

• EDR Server: 7.x

Resolution

1.  Leave services or cluster running.
2.  Generate the new writer core which causes Solr to roll the previous writer core to warm.  

• On the Primary server execute:

curl -H "X-Auth-Token: `psql -p 5002 -d cb -t -c 'select auth_token from cb_user where id = '1';'`" -XPOST -k "https://localhost/api/v1/storage/events/new_partition"

• On the Minion server execute (Skip step if stand-alone server):

curl -H "X-Auth-Token:<admin user token from Primary>" -XPOST -k "https://localhost/api/v1/storage/events/new_partition"

3.  Confirm the new Solr core was generated.

ls -latr /var/cb/data/solr/cbevents

      The last entry should have a current date timestamp.

4.  Confirm the new warm core has the correct name in core.properties.

cat /var/cb/data/solr/cbevents/<name of previous cbevents directory>/core.properties 

(Variable 'name=' should match the folder name.)

5.  Confirm the new writer core has the name 'writer' inside core.properties file.

cat /var/cb/data/solr/cbevents/<name of newly created cbevents directory>/core.properties

(The variable name should contain 'name=writer')

 

Additional Information

• Preferably open an EDR Support case to get assistance.
• If the WebUI port has been changed then add :PORT to the localhost:PORT of the command.