EDR: No Cold Cores Available Even Though AlwaysDeleteColdPartitions=True is Commented Out

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Cores older than 30 days are not present on the server despite 'AlwaysDeleteColdPartitions=True' being commented out

Environment

• EDR Server: All Supported Versions

Cause

The default value for this setting is True, even if it is commented out

Resolution

Enable cold storage: https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-enable-event-cold-storage/ta-p/64479

Additional Information

Ensure storage has sufficient space for cold cores. It is best practice to move the cores to another storage unit.