EDR: How to Collect a Java Heap Dump from Solr or Datastore

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to collect a Java heap dump from Solr or Datastore for investigation or performance issues.

Environment

• EDR Server: All Supported Versions

Resolution

1. Install jmap

   sudo yum install java-11-openjdk-devel

2. Run this command to generate a heap dump, this will generally be the size of the memory Solr or Datastore is using, please make sure there is adequate space available in this path. This should be done while experiencing the performance issue such as slow ingestion. Support will request which service you need a heap dump capture on. 

   For Solr:
   sudo -u cb jmap -dump:format=b,file=/var/cb/data/solr.hprof.<distinguishable name>.bin $(/usr/share/cb/cbquery service-pid cb-solr)
   
   For Datastore: 
   sudo -u cb jmap -dump:format=b,file=/var/cb/data/solr.hprof.<distinguishable name>.bin $(/usr/share/cb/cbquery service-pid cb-datastore)

3. Compress the heap dump with gzip

   cd /var/cb/data
   tar -cvzf solr.hprof.<distinguishable name>.tar.gz solr.hprof.<distinguishable name>.bin

4. Send the heap dump to Alliance or upload to the support portal (N

   /usr/share/cb/cbpost solr.hprof.<distinguishable name>.tar.gz

5. Send a fresh set to of cbdiags to Alliance or upload to the support portal

   /usr/share/cb/cbdiag --post

6. Delete the heap dump and compressed file to get the space back. 

   rm -f /var/cb/data/solr.hprof.*

Additional Information

• The collection of the heap dump is helpful in determining what is generating the most heap memory on a thread.