EDR: NoSuchFileException: /var/cb/data/solr6/cbevents/cbevents_XXXXX

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• The following errors in the /var/log/cb/solr/debug.log:

2020-04-21 08:40:57,124 - [ERROR] - from com.carbonblack.cbfs.solr.CbProcessUpdateRequestProcessorBase in qtp1157740463-92985
Insert document exception
org.apache.solr.common.SolrException: Exception writing document id 00004578-0000-17c4-01d6-17310bb4b9f3-01719b77e06c to the index; possible analysis error.
...
Caused by: java.nio.file.NoSuchFileException: /var/cb/data/solr6/cbevents2/cbevents_XXXXX/data/index/write.lock

 

Environment

• EDR (formerly CB Response): All Supported Versions

Cause

Solr detects a missing SOLR core directory located at /var/cb/data/solr6/cbevents/cbevents_XXXXX

Resolution

• This may include the writer core, which can be verified by checking the following:
  • The writer core should be the most recent core.  It can be verified (if the directory exists) by taking a look at the contents of the core.properties file in the cbevents_XXXX directory: 

cat /var/cb/data/solr6/cbevents/cbevents_XXXX/core.properties

• The writer core should look like the following:

#Written by CarbonBlackSupport 
#CURRENTDATE
name=writer 
configSet=cbevents_v2

• If the writer core is missing, please follow this KB to create a new one : CB-Response-Writer-Core-is-Missing
• Once the writer core is verified and the core directory that is reported missing is confirmed or removed if empty:
  • Restart cb-datastore and cb-solr services : 

sudo service cb-datastore restart && sudo service cb-solr restart

• Errors should cease and SOLR should continue functioning normally.  If this is not the case, please contact Carbon Black Support.