EDR: Solr fails creating writer core

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensors report Online, but missing current event data.
• Nginx access.log shows constant stream of "503" status.
• Following error is seen in Solr debug.log:

  [ERROR] - from org.apache.solr.core.CoreContainer in coreContainerWorkExecutor-2-thread-1
  
  Error waiting for SolrCore to be created
  
  java.util.concurrent.ExecutionException: org.apache.solr.common.SolrException: Unable to create core [writer ]

Environment

• EDR Server: 6.X and higher

Cause

Current core has extra spacing in "writer" name within /var/cb/data/solr5/cbevents/<CORENAME>/core.properties

Resolution

Confirm the core.properties file is set correctly:

#Written by CorePropertiesLocator
#TIMESTAMP
name=writer
configSet=cbevents_v2

Additional Information

To view special characters in vi, use the command

:set list