EDR: When Sensor Goes Offline, Related Process Count On Its Sensor Details Page Goes To Zero

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Related processes count on affected sensor details page in EDR UI drops to zero when sensor goes offline.
• EDR UI shows no indication of performance or other issues.

Environment

• EDR Server: 7.5.0 and Higher

Cause

EDR Server is severely under-resourced in terms of disk sizes on the nodes, which causes SOLR cores to purge data as soon as these cores rollover.

Resolution

Review OER requirements and increase resources as necessary to meet OER: https://docs.vmware.com/en/VMware-Carbon-Black-EDR/7.5/cb-edr-oer-guide/GUID-AA6036C7-76FC-4C40-99DE-FC6AACD55442.html