EDR Server: What are the cbevents directories in /var/cb/data/solr*/?
search cancel

EDR Server: What are the cbevents directories in /var/cb/data/solr*/?

book

Article ID: 289700

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What are the cbevents directories created under /var/cb/data/solr*/ and why do they take up so much disk space? 

Environment

  • EDR Server: All versions

Resolution

  • The cbevents folders contain all process and event information sent from endpoints. 
  • It is expected that this location will take up a majority of disk space

Additional Information

If server is being pushed over disk limitations, retention settings can be adjusted via the MaxEventStore* variables. Further information on these variables can be found under the "Data Storage" section in the Server Config Guide.