EDR: Services Not Starting After Upgrading Server Due to Reader Core Errors
book
Article ID: 287946
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- Services not starting
- After upgrading the server errors are seen regarding the Solr Reader core
- /var/log/cb/solr/debug.log may show this error
2021-03-05 14:39:21,418 - [ERROR] - from com.carbonblack.cbfs.solr.CbProcessUpdateRequestProcessorBase in qtp146874094-30 [x:writer]
Insert document exception
org.apache.solr.client.solrj.impl.HttpSolrClient$RemoteSolrException: Error from server at http://localhost:8080/solr: Expected mime type application/octet-stream but got text/html. <html>
<head>
<meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
<title>Error 404 Not Found</title>
</head>
<body><h2>HTTP ERROR 404 Not Found</h2>
<table>
<tr><th>URI:</th><td>/solr/reader/select</td></tr>
<tr><th>STATUS:</th><td>404</td></tr>
<tr><th>MESSAGE:</th><td>Not Found</td></tr>
<tr><th>SERVLET:</th><td>default</td></tr>
</table>
Cause
Solr Reader core is missing
Resolution
- Confirm the reader core is missing
ls -lh /var/cb/data/solr/cbevents/
- If missing, manually create the core
- mkdir /var/cb/data/solr/cbevents/reader
- echo name=reader > /var/cb/data/solr/cbevents/reader/core.properties
- echo configSet=cbevents_v2 >> /var/cb/data/solr/cbevents/reader/core.properties
- chown cb:cb /var/cb/data/solr/cbevents/reader -R
- Restart services
Additional Information
- Cause of this is unknown. An individual report was after an upgrade from 6.3.1 to 7.4.1
Feedback
thumb_up
Yes
thumb_down
No