EDR: How to adjust maximum Solr core sizes

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Set a maximum Solr core size

Environment

• EDR Server: 6.2.4 and Higher (Formerly CB Response)

Resolution

1. Determine desired maximum core size with Carbon Black
2. On all nodes of the instance, edit /etc/cb/cb.conf
3. Add/edit the SolrTimePartitioningMaxSizeMB to the desired core size

   • SolrTimePartitioningMaxSizeMB=<size_in_MB> 

4. Restart services

Additional Information

Cores will roll over once the max size is hit. If the active size is too small cores will roll over too quickly and may be removed from the server sooner than expected based on SolrTimePartitioningActivePartitions.