EDR: Solr Partition Optimization Has Been Disabled
search cancel

EDR: Solr Partition Optimization Has Been Disabled

book

Article ID: 287658

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Solr core did not optimize and the job-runner log states "Skipping optimization of partition because optimization on cbevents_YYYY_MM_DD_HHMM has been disabled"

Environment

  • EDR Servers: 7.x

Cause

The /var/cb/data/solr/cbevents/cbevents_YYYY_MM_DD_HHMM/cb.core.conf variable 'optimization_disabled' was set to True.

Resolution

Modify the cb.core.conf variable to False.
optimization_disabled = False


 

Additional Information

  • To view the optimization for all cores, run command below on each EDR server.
curl "http://127.0.0.1:8080/solr/admin/cores?action=STATUS&wt=json&indexInfo=true&indent=true" 2>&1 | grep 'name\|size\|segmentCount'
  • If EDR set the variable to True, there is an underlying problem with disk space, missing mounted disks, etc.  Check '/var/log/messages', 'df -h'. /etc/fstab
  • Large clusters may leave the Primary server eventless and without Solr cores.