EDR: Services Not Starting After Upgrading Server Due to Reader Core Errors
search cancel

EDR: Services Not Starting After Upgrading Server Due to Reader Core Errors

book

Article ID: 287946

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Services not starting
  • After upgrading the server errors are seen regarding the Solr Reader core
  • /var/log/cb/solr/debug.log may show this error 
    2021-03-05 14:39:21,418 - [ERROR] - from com.carbonblack.cbfs.solr.CbProcessUpdateRequestProcessorBase in qtp146874094-30 [x:writer]
Insert document exception
org.apache.solr.client.solrj.impl.HttpSolrClient$RemoteSolrException: Error from server at http://localhost:8080/solr: Expected mime type application/octet-stream but got text/html. <html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Error 404 Not Found</title>
</head>
<body><h2>HTTP ERROR 404 Not Found</h2>
<table>
<tr><th>URI:</th><td>/solr/reader/select</td></tr>
<tr><th>STATUS:</th><td>404</td></tr>
<tr><th>MESSAGE:</th><td>Not Found</td></tr>
<tr><th>SERVLET:</th><td>default</td></tr>
</table>

 

Environment

  • EDR Server: 7.4.1

Cause

Solr Reader core is missing

Resolution

  1. Confirm the reader core is missing 
    ls -lh /var/cb/data/solr/cbevents/
  2. If missing, manually create the core 
    - mkdir /var/cb/data/solr/cbevents/reader
- echo name=reader > /var/cb/data/solr/cbevents/reader/core.properties
- echo configSet=cbevents_v2 >> /var/cb/data/solr/cbevents/reader/core.properties
- chown cb:cb /var/cb/data/solr/cbevents/reader -R
  3. Restart services

Additional Information

  • Cause of this is unknown. An individual report was after an upgrade from 6.3.1 to 7.4.1
Powered by Wolken Software