EDR Server: What are the cbevents directories in /var/cb/data/solr*/?
book
Article ID: 289700
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
What are the cbevents directories created under /var/cb/data/solr*/ and why do they take up so much disk space?
Environment
EDR Server: All versions
Resolution
The cbevents folders contain all process and event information sent from endpoints.
It is expected that this location will take up a majority of disk space
Additional Information
If server is being pushed over disk limitations, retention settings can be adjusted via the MaxEventStore* variables. Further information on these variables can be found under the "Data Storage" section in the Server Config Guide.