EDR: Solr Partition Optimization Has Been Disabled

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Solr core did not optimize and the job-runner log states "Skipping optimization of partition because optimization on cbevents_YYYY_MM_DD_HHMM has been disabled"

Environment

• EDR Servers: 7.x

Cause

The /var/cb/data/solr/cbevents/cbevents_YYYY_MM_DD_HHMM/cb.core.conf variable 'optimization_disabled' was set to True.

Resolution

Modify the cb.core.conf variable to False.

optimization_disabled = False

 

Additional Information

• To view the optimization for all cores, run command below on each EDR server.

curl "http://127.0.0.1:8080/solr/admin/cores?action=STATUS&wt=json&indexInfo=true&indent=true" 2>&1 | grep 'name\|size\|segmentCount'

• If EDR set the variable to True, there is an underlying problem with disk space, missing mounted disks, etc.  Check '/var/log/messages', 'df -h'. /etc/fstab
• Large clusters may leave the Primary server eventless and without Solr cores.