EDR: No Cold Cores Available Even Though AlwaysDeleteColdPartitions=True is Commented Out
book
Article ID: 290563
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Cores older than 30 days are not present on the server despite 'AlwaysDeleteColdPartitions=True' being commented out
Environment
- EDR Server: All Supported Versions
Cause
The default value for this setting is True, even if it is commented out
Resolution
Enable cold storage: https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-enable-event-cold-storage/ta-p/64479
Additional Information
Ensure storage has sufficient space for cold cores. It is best practice to move the cores to another storage unit.
Feedback
thumb_up
Yes
thumb_down
No