Triage Alerts, Process Search, and Binary Search pages are blank

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Requests in Nginx show HTTP 500 Responses
• Coreservices debug.log shows 404 errors to Solr

  • <err>  cb.flask.blueprint_helpers - Unhandled exception from API request: HTTP Failure Code 404
    Traceback (most recent call last):
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/flask/app.py", line 1813, in full_dispatch_request
        rv = self.dispatch_request()
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/flask/app.py", line 1799, in dispatch_request
        return self.view_functions[rule.endpoint](**req.view_args)
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/auth/auth.py", line 174, in wrapped_f
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/flask/blueprints/api_blueprint.py", line 477, in search_alerts_v1
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/flask/blueprints/api_blueprint.py", line 492, in _do_alerts_search
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/api/solr_api/alert_store.py", line 187, in search
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/api/solr_api/alert_store.py", line 57, in execute
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/api/solr_api/solr_store_base.py", line 469, in execute
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/utils/solr_client.py", line 707, in all
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/utils/solr_client.py", line 677, in get_response
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/utils/solr_client.py", line 289, in get_raw_response
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/utils/solr_client.py", line 780, in _execute_query
      File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/utils/solr_client.py", line 312, in _execute_query
    SolrClientHttpError: HTTP Failure Code 404

Environment

• EDR Server: All Supported Versions
• Linux: All Supported Versions

Cause

• Multiple cores in solr are set as the writer core in cb.conf

Resolution

1. Stop services:
   1. Standalone

      • sudo service cb-enterprise stop

   2. Cluster

      • sudo /usr/share/cb/cbcluster stop

2. Open /var/cb/data/solr6/cbevents/<duplicate_core>/core.properties with a text editor. <duplicate_core> will be the name of the core with the earlier created timestamp
3. Change 'name=writer' to 'name=<duplicate_core>' 
4. Save the file
5. Start services back up:
   • Standalone

     • sudo service cb-enterprise start

   • Cluster

     • sudo /usr/share/cb/cbcluster start