Writer Core is Missing or Corrupted

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black EDR

Issue/Introduction

• Reoccurring error in /var/log/cb/enterprise log: 

  • <warning> cb.utils.solr_client - Error looking for writer partition. 
    <warning> cb.enterprise.tasks.solr_time_partitioner - Could not determine the current partition time. Skipping partitioning.

    
     

Environment

• Carbon Black EDR Server: 6.X and Higher

Cause

Writer core was not able to be created or previous writer core is corrupted and not ingesting new data.

Resolution

NOTE: Your directory may be /var/cb/data/solr6/cbevents for example if you have upgraded from an older version

1. Stop services if they are running using this KB
2. If a empty core with a date newer than the prior writer core is present, skip to step 3. Otherwise, follow step 2:
   1. Create a new core directory:

      mkdir /var/cb/data/solr/cbevents/cbevents_YYYY_MM_DD_HHmm/

      Example:  

      mkdir /var/cb/data/solr/cbevents/cbevents_2025_08_14_1544/

   2. Set the correct permissions:

      chown cb:cb /var/cb/data/solr/cbevents/CORENAME

      Example: 

      chown cb:cb /var/cb/data/solr/cbevents/cbevents_2025_08_14_1544

3. Set this core to the writer core through the core.properties file
   1. Create the file:

      touch /var/cb/data/solr/cbevents/CORENAME/core.properties

      Example: 

      touch /var/cb/data/solr/cbevents/cbevents_2025_08_14_1544/core.properties

   2. Set the correct permissions:

      chown cb:cb /var/cb/data/solr/cbevents/CORENAME/core.properties

      Example:

      chown cb:cb /var/cb/data/solr/cbevents/cbevents_2025_08_14_1544/core.properties

   3. Add the following content to the core.properties file:

      #Written by CarbonBlackSupport 
      #CURRENTDATE
      name=writer
      configSet=cbevents_v2

4. Start Services using the same KB from step 1.