Solr Fails to Start with "This version of Lucene only supports indexes created with release 4.0 and later"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Solr is failing to start. 

• /var/log/cb/solr/debug log shows a similar error 

  BufferedChecksumIndexInput(MMapIndexInput(path="/var/cb/data/solr/cbfeeds/data/index/segments_9m4"))): -1682135807 (needs to be between 1071082519 and 1071082519). This version of Lucene only supports indexes created with release 4.0 and later.

Environment

• Carbon Black EDR Server: All Versions

Cause

Index corruption

Resolution

1. Log in to the back end server via SSH/Terminal session
2. Navigate to the directory listed in the error message
3. Rename the index folder (Note: Using the example path from the error above where the path is for the cbfeeds core)

   mv /var/cb/data/solr/cbfeeds/index /var/cb/data/solr/cbfeeds/index_back

4. Restart the server services

Additional Information

• Reason for corruption is unknown. Common causes
  
  • Disk is failing.
  • AV Interferrence. 
  • Backup software interferring during the write. 
• After services have successfully started, the index_back folder can safely be removed
• Restart the services. How to Start, Stop and Restart EDR Application Services