EDR: Solr Partition Optimization Has Been Disabled
book
Article ID: 287658
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Solr core did not optimize and the job-runner log states "Skipping optimization of partition because optimization on cbevents_YYYY_MM_DD_HHMM has been disabled"
Environment
EDR Servers: 7.x
Cause
The /var/cb/data/solr/cbevents/cbevents_YYYY_MM_DD_HHMM/cb.core.conf variable 'optimization_disabled' was set to True.
Resolution
Modify the cb.core.conf variable to False.
optimization_disabled = False
Additional Information
To view the optimization for all cores, run command below on each EDR server.
If EDR set the variable to True, there is an underlying problem with disk space, missing mounted disks, etc. Check '/var/log/messages', 'df -h'. /etc/fstab
Large clusters may leave the Primary server eventless and without Solr cores.