CB Response: Alerts page does not load

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Alerts page fails to load any data
• Watchlists show Error under each watchlist name
• Restarting services fails to start after Solr. Services can manually be started one at a time
• Solr's debug.log shows error

  • Found multiple cores with the name [writer], with instancedirs [/var/cb/data/solr5/cbevents/cbevents_YYYY_MM_DD_SSSS] and [/var/cb/data/solr5/cbevents/cbevents_YYYY_MM_DD_SSSS]

• Coreservices debug.log shows error

  • <err> cb.utils.solr_client - Request to http://localhost:8080/solr/cbalerts/select failed with error <404 - Not Found>.

    
     

Environment

• CB Response Server: 6.x

Cause

Multiple cores with the name 'writer' prevent Solr from starting properly

Resolution

1. Connect to the server's command line interface
2. Stop services
3. Edit the core.properties file of the cbevents core with the older date

   • vi /var/cb/data/solr5/cbevents/cbevents_YYYY_MM_DD_SSSS/core.properties

4. Change the name field from 'writer', to the name of the core/folder

   • name=cbevents_YYYY_MM_DD_SSSS

5. Save and close the file

   • :wq

6. Start services

Additional Information

• In a clustered environment, the error may appear on any of the active nodes. Steps to rename the core must be performed on the node with the error
• Watchlists will show Error until the next time the back-end job to run the watchlist has completed
• An editor besides vi can be used to edit core.properties