EDR: Disk Partition Filling on Multi-Partition Cbevents
search cancel

EDR: Disk Partition Filling on Multi-Partition Cbevents

book

Article ID: 287985

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

One of the cbevent partitions is filling up

Environment

  • EDR Server: 6.2.4 and Higher

Cause

Configuration is set to low or high

Resolution

  1. Log onto the backend of the server via ssh/terminal
  2. Open /etc/cb/cb.conf
  3. Edit this configuration to provide more room
    SolrTimePartitioningFreeSpaceThresholdPerc=10
  4. Restart services

Additional Information

  • By default this is set to 5%. In most environments this is enough to properly purge. Other environments can run over the 5% during core optimization causing the disk to fill
  • This setting should not be set to a high value. Example¬†SolrTimePartitioningFreeSpaceThresholdPerc=85 will also cause disk to fill