EDR: Disk Partition Filling on Multi-Partition Cbevents

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

One of the cbevent partitions is filling up

Environment

• EDR Server: 6.2.4 and Higher

Cause

Configuration is set to low or high

Resolution

1. Log onto the backend of the server via ssh/terminal
2. Open /etc/cb/cb.conf
3. Edit this configuration to provide more room

   SolrTimePartitioningFreeSpaceThresholdPerc=10

4. Restart services

Additional Information

• By default this is set to 5%. In most environments this is enough to properly purge. Other environments can run over the 5% during core optimization causing the disk to fill
• This setting should not be set to a high value. Example SolrTimePartitioningFreeSpaceThresholdPerc=85 will also cause disk to fill