EDR: Unexpected Log Entry or Corrupt Log Causing Solr Not to Start
book
Article ID: 289923
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Show More
Show Less
Cause
Usually caused by Solr not being properly shut down while indexing.
Resolution
Create a corrupt tlog directory and move all tlogs to this directory
mkdir /var/cb/data/solr/cbevents/0/data/tlogcorrupt mv /var/cb/data/solr/cbevents/0/data/tlog/tlog.* /var/cb/data/solr/cbevents/0/data/tlogcorrupt/
Repeat the process for any remaining shards
Stop any remaining services
Standalone
service cb-enterprise stop
Cluster
/usr/share/cb/cbcluster stop
Remove all cb user owned processes
killall -KILL -u cb
Start the Services
Standalone
service cb-enterprise start
Cluster
/usr/share/cb/cbcluster start
Remove the tlogcorrupt folder once services have started
rm -rf /var/cb/data/solr/cbevents/0/data/tlogcorrupt
Repeat the process for any remaining shards
Additional Information
The tlog are raw documents created for recovery purposes. Since these are now corrupt, they are no longer useful. If they are left behind, solr will take up more disk space than what is specified in /etc/cb/cb.conf.
Feedback
thumb_up
Yes
thumb_down
No