Is it safe to remove a corrupted cbmodules core?

Products

• Carbon Black EDR

Issue/Introduction

Is it safe to remove a cbmodules core and will the server automatically create a new one?

Environment

• Carbon Black EDR Server: All Supported Versions

Resolution

Yes, it is safe to remove the cbmodules core if certain precautions are taken:

1. Stop the EDR cluster.
2. Attempt to repair the cbmodules core
3. If the repair fails, make a backup:

   mv /var/cb/data/solr/cbmodules /tmp/some_backup_directory/

4. Restart the cluster.
5. A new cbmodules directory and core will be recreated automatically. 

Additional Information

• All cbmodules data for that node on the cluster (or the entire system if it's a stand-alone server) will be lost. This relates to stored binaries on the server. 
• These steps should only be used as a last resort.