EDR: Startup Stalls on Solr Building Dictionaries

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Starting EDR services, Solr hangs stating "building dictionaries".
• /var/log/cb/solr/startup.log contains exception:

ERROR SolrDispatchFilter Could not start Solr. Check solr/home property and the logs
ERROR SolrCore null:java.lang.NoClassDefFoundError: org/apache/logging/log4j/core/Appender
<stack trace>
Caused by: java.lang.ClassNotFoundException: org.apache.logging.log4j.core.Appender

 

Environment

• EDR Server: 7.6.x

Cause

The /usr/share/cb/solr/server/lib/ext/log4j.core-2.17.1.jar file missing.

Resolution

• Upgrade to EDR 7.7.x or greater.
• Check the files in /usr/share/cb/solr/server/lib/ext/ and confirm log4j-core-2.17.1.jar (or later) is there and has matching permissions.  If it is missing upgrade EDR or move the file from a working EDR server.