CB Response: Startup hangs on Solr indexing after upgrade

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

 

• Errors like the following appear in /var/log/cb/solr/debug.log

  • [ERROR] - from org.apache.solr.core.SolrCore in main null:org.apache.solr.common.SolrException: Found multiple cores with the name [cbevents_2018_05_26_1434], with instancedirs [/cbevents1/solr5/cbevents/cbevents_2018_05_26_1434] and [/cbeven 
    ts1/solr5/cbevents/cbevents_2018_05_29_1459]

• There are multiple drives storing Solr cores (cbevents)

Environment

• CB Response: All Versions

Cause

This is a known issue that occurs when multiple drives are used to store active Solr cores - CB-21353

Resolution

1. Determine which cbevents folder (core) name does not match the core name listed in the error.
   • In the error above that would be cbevents_2018_05_29_1459
2. In the mismatched core's core.properties file, edit the name field to match the core's folder name 
3. Restart services - Cb Response: How to restart services