EDR: When Sensor Goes Offline, Related Process Count On Its Sensor Details Page Goes To Zero
book
Article ID: 287164
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Related processes count on affected sensor details page in EDR UI drops to zero when sensor goes offline.
EDR UI shows no indication of performance or other issues.
Environment
EDR Server: 7.5.0 and Higher
Cause
EDR Server is severely under-resourced in terms of disk sizes on the nodes, which causes SOLR cores to purge data as soon as these cores rollover.
Resolution
Review OER requirements and increase resources as necessary to meet OER: https://docs.vmware.com/en/VMware-Carbon-Black-EDR/7.5/cb-edr-oer-guide/GUID-AA6036C7-76FC-4C40-99DE-FC6AACD55442.html