EDR: Solr unable to start due to IndexFormatTooOldException

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Solr unable to start
• Error in /var/log/cb/solr/debug.log

[ERROR] - from org.apache.solr.servlet.HttpSolrCall in qtp572868060-23 []
null:org.apache.solr.core.SolrCoreInitializationException: SolrCore 'cbmodules' is not available due to init failure: Error opening new searcher

 

Caused by: org.apache.lucene.index.IndexFormatTooOldException: Format version is not supported (resource BufferedChecksumIndexInput(MMapIndexInput(path="/var/cb/data/solr5/cbevents/cbevents_2021_10_13_1519/data/index/segments_9y"))): 0 (needs to be between 1071082519 and 1071082519). This version of Lucene only supports indexes created with release 6.0 and later.

 

Environment

• EDR(Formerly Carbon Black Response) Server: All Supported Versions

Cause

• Solr Index corruption.

Resolution

• To delete the index, move `/var/cb/data/solr/cbmodules/data/index` to `/var/cb/data/solr/cbmodules/data/index_back`
• Restart EDR services