EDR: Do Not Use SolrEventPartitionManagementUseNewAlgorithm variable

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

After adding SolrEventPartitionManagementUseNewAlgorithm=True to cb.conf, the Solr reader cores were removed.  The writer core remains.

Environment

• EDR Server: 7.5 to 7.8

Cause

The feature SolrEventPartitionManagementUseNewAlgorithm in some environments does not work as designed.

Resolution

Refrain from using SolrEventPartitionManagementUseNewAlgorithm in cb.conf until further notice.

Additional Information

• The feature was introduced to EDR 7.5.0 to address the increasing use of multiple cbevents* partitions.
• The configuration variable is a hidden variable and is not listed in the Server Configuration Guides.
• There have been two cases where the variable removed the current Solr cbevents cores.
• The algorithm fix is expected in EDR v7.8.1