EDR: No cb.core.conf found for cold partition

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• job-runner.log contains the following error with a dated directory:

<warning> [statsmon] No cb.core.conf found for cold partition cbevents_date/

• /etc/cb/cb.conf under Solr Storage Engine Settings the following value is set 

  AlwaysDeleteColdPartitions=True
  

• The contents of /var/cb/data/solr*/cbevents_date do not contain a core.properties file or a cb.core.conf file.

Environment

• EDR (formerly CB Response): 6.x and Higher

Cause

A Cold Storage directory exists without Cold Storage enabled. This generates an error as a cb.core.conf file is expected in the directory.

Resolution

If Cold Storage is not enabled and this directory is empty, it can be safely deleted.