EDR: NoSuchFileException: /var/cb/data/solr6/cbevents/cbevents_XXXXX
search cancel

EDR: NoSuchFileException: /var/cb/data/solr6/cbevents/cbevents_XXXXX

book

Article ID: 287409

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • The following errors in the /var/log/cb/solr/debug.log:
2020-04-21 08:40:57,124 - [ERROR] - from com.carbonblack.cbfs.solr.CbProcessUpdateRequestProcessorBase in qtp1157740463-92985
Insert document exception
org.apache.solr.common.SolrException: Exception writing document id 00004578-0000-17c4-01d6-17310bb4b9f3-01719b77e06c to the index; possible analysis error.
...
Caused by: java.nio.file.NoSuchFileException: /var/cb/data/solr6/cbevents2/cbevents_XXXXX/data/index/write.lock

 

Environment

  • EDR (formerly CB Response): All Supported Versions

Cause

Solr detects a missing SOLR core directory located at /var/cb/data/solr6/cbevents/cbevents_XXXXX

Resolution

  • This may include the writer core, which can be verified by checking the following:
    • The writer core should be the most recent core.  It can be verified (if the directory exists) by taking a look at the contents of the core.properties file in the cbevents_XXXX directory: 
cat /var/cb/data/solr6/cbevents/cbevents_XXXX/core.properties
  • The writer core should look like the following:
#Written by CarbonBlackSupport 
#CURRENTDATE
name=writer 
configSet=cbevents_v2
  • If the writer core is missing, please follow this KB to create a new one : CB-Response-Writer-Core-is-Missing
  • Once the writer core is verified and the core directory that is reported missing is confirmed or removed if empty:
    • Restart cb-datastore and cb-solr services : 
sudo service cb-datastore restart && sudo service cb-solr restart

  • Errors should cease and SOLR should continue functioning normally.  If this is not the case, please contact Carbon Black Support.