EDR: No cb.core.conf found for cold partition
search cancel

EDR: No cb.core.conf found for cold partition

book

Article ID: 287351

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • job-runner.log contains the following error with a dated directory:
<warning> [statsmon] No cb.core.conf found for cold partition cbevents_date/
  • /etc/cb/cb.conf under Solr Storage Engine Settings the following value is set 
    AlwaysDeleteColdPartitions=True
    
  • The contents of /var/cb/data/solr*/cbevents_date do not contain a core.properties file or a cb.core.conf file.

Environment

  • EDR (formerly CB Response): 6.x and Higher

Cause

A Cold Storage directory exists without Cold Storage enabled. This generates an error as a cb.core.conf file is expected in the directory.

Resolution

If Cold Storage is not enabled and this directory is empty, it can be safely deleted.