EDR: When Sensor Goes Offline, Related Process Count On Its Sensor Details Page Goes To Zero
search cancel

EDR: When Sensor Goes Offline, Related Process Count On Its Sensor Details Page Goes To Zero

book

Article ID: 287164

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Related processes count on affected sensor details page in EDR UI drops to zero when sensor goes offline.
  • EDR UI shows no indication of performance or other issues.

Environment

  • EDR Server: 7.5.0 and Higher

Cause

EDR Server is severely under-resourced in terms of disk sizes on the nodes, which causes SOLR cores to purge data as soon as these cores rollover.

Resolution

Review OER requirements and increase resources as necessary to meet OER: https://docs.vmware.com/en/VMware-Carbon-Black-EDR/7.5/cb-edr-oer-guide/GUID-AA6036C7-76FC-4C40-99DE-FC6AACD55442.html