EDR: Disk Partition Filling on Multi-Partition Cbevents
book
Article ID: 287985
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
One of the cbevent partitions is filling up
Environment
EDR Server: 6.2.4 and Higher
Cause
Configuration is set to low or high
Resolution
Log onto the backend of the server via ssh/terminal
Open /etc/cb/cb.conf
Edit this configuration to provide more room
SolrTimePartitioningFreeSpaceThresholdPerc=10
Restart services
Additional Information
By default this is set to 5%. In most environments this is enough to properly purge. Other environments can run over the 5% during core optimization causing the disk to fill
This setting should not be set to a high value. Example SolrTimePartitioningFreeSpaceThresholdPerc=85 will also cause disk to fill