EDR: Services Not Starting After Upgrading Server Due to Reader Core Errors
search cancel

EDR: Services Not Starting After Upgrading Server Due to Reader Core Errors

book

Article ID: 287946

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Services not starting
  • After upgrading the server errors are seen regarding the Solr Reader core
  • /var/log/cb/solr/debug.log may show this error
    2021-03-05 14:39:21,418 - [ERROR] - from com.carbonblack.cbfs.solr.CbProcessUpdateRequestProcessorBase in qtp146874094-30 [x:writer]
    Insert document exception
    org.apache.solr.client.solrj.impl.HttpSolrClient$RemoteSolrException: Error from server at http://localhost:8080/solr: Expected mime type application/octet-stream but got text/html. <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html;charset=utf-8"/>
    <title>Error 404 Not Found</title>
    </head>
    <body><h2>HTTP ERROR 404 Not Found</h2>
    <table>
    <tr><th>URI:</th><td>/solr/reader/select</td></tr>
    <tr><th>STATUS:</th><td>404</td></tr>
    <tr><th>MESSAGE:</th><td>Not Found</td></tr>
    <tr><th>SERVLET:</th><td>default</td></tr>
    </table>

 

Environment

  • EDR Server: 7.4.1

Cause

Solr Reader core is missing

Resolution

  1. Confirm the reader core is missing
    ls -lh /var/cb/data/solr/cbevents/
  2. If missing, manually create the core
    - mkdir /var/cb/data/solr/cbevents/reader
    - echo name=reader > /var/cb/data/solr/cbevents/reader/core.properties
    - echo configSet=cbevents_v2 >> /var/cb/data/solr/cbevents/reader/core.properties
    - chown cb:cb /var/cb/data/solr/cbevents/reader -R
  3. Restart services

Additional Information

  • Cause of this is unknown. An individual report was after an upgrade from 6.3.1 to 7.4.1