EDR: SOLR Failed due to No cb.core.conf found for cold partition

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• SOLR is not working correctly.
• Latest process events are not populating.
• Writer core did not roll over as expected.
• Errors in /var/log/cb/job-runner/job-runner.log:

2018-12-18 15:20:06 [12460] <err> [statsmon] statsmon exception while processing solr_core_stats: 'schema' 
Traceback (most recent call last): 
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/maintenance/jobs/statsmon.py", line 49, in get 
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/maintenance/jobs/statsmon.py", line 215, in _get_solr_core_stats 
KeyError: 'schema' 

2018-12-18 15:20:06 [12460] <warning> [statsmon] No cb.core.conf found for cold partition cbevents_2018_01_05_1645

Environment

• EDR Server: All versions

Cause

• A cold partition was improperly moved back to /var/cb/data/solr*/cbevents.
• SOLR tried to mount the cold partition but found no cb.core.conf.

Resolution

1. Stop the EDR services/cluster.
2. Move the cold partition to a different location:

# mv /var/cb/data/solr*/cbevents/cbevents_<cold partition in error> <another path>

Example:

# mv /var/cb/data/solr5/cbevents/cbevents_2018_01_05_1645 /backups/cold_partitions/

3. Start services/cluster.