CB Response: Solr won't start with "This version of Lucene only supports indexes created with release 4.0 and later"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

/var/log/cb/solr/debug log shows a similar error

BufferedChecksumIndexInput(MMapIndexInput(path="/var/cb/data/solr5/cbfeeds/data/index/segments_9m4"))): -1682135807 (needs to be between 1071082519 and 1071082519). This version of Lucene only supports indexes created with release 4.0 and later.

Environment

• Carbon Black Response Server: 6.x and higher

Cause

Index corruption

Resolution

1. Log in to the back end server via SSH/Terminal session
2. Navigate to the directory listed in the error message
3. Rename the index folder (Note: using the example path from the error above)

   mv /var/cb/data/solr5/cbfeeds/index /var/cb/data/solr5/cbfeeds/index_back

4. Restart the server services CB Response: How to restart server services

Additional Information

• Reason for corruption is unknown
• After services have successfully started, the index_back folder can safely be removed