EDR: Services hang on SOLR during startup after adding new storage volume

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• cb-enterprise services hang at SOLR during startup
• new storage volume added

Environment

• EDR Server: 6.1.2 and higher

Cause

• The new storage volume is missing a dated 'cbevents' directory in /var/cb/data/solr5/cbevents2
• The new storage volume is missing a core.properties file in /var/cb/data/solr5/cbevents2

Resolution

• Create a cbevents directory in /var/cb/data/solr5/cbevents2

1. cd /var/cb/data/solr5/cbevents2
2. mkdir cbevents_<year>_<month>_<day>_1704

• Create a core.properties file
  1. cd /var/cb/data/solr5/cbevents2
  2. touch core.properties
  3. vi core.properties
     • Add the following lines in the core.properties file
     1. name=writer
     2. configSet=cbevents_v1

Additional Information

• Verify the events schema prior to setting the 'configSet=' value in the core.properties file. This can be achieved by searching for 'CurrentEventsSchema=cbevents_v2' in the cb.conf. If the prior entry is not found the default cbevents_v1 schema is being used.