EDR: Solr fails creating writer core
search cancel

EDR: Solr fails creating writer core

book

Article ID: 287747

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Sensors report Online, but missing current event data.
  • Nginx access.log shows constant stream of "503" status.
  • Following error is seen in Solr debug.log:
    [ERROR] - from org.apache.solr.core.CoreContainer in coreContainerWorkExecutor-2-thread-1
    
    Error waiting for SolrCore to be created
    
    java.util.concurrent.ExecutionException: org.apache.solr.common.SolrException: Unable to create core [writer ]

Environment

  • EDR Server: 6.X and higher

Cause

Current core has extra spacing in "writer" name within /var/cb/data/solr5/cbevents/<CORENAME>/core.properties

Resolution

Confirm the core.properties file is set correctly:
#Written by CorePropertiesLocator
#TIMESTAMP
name=writer
configSet=cbevents_v2

Additional Information

To view special characters in vi, use the command
:set list