CB Response: Disk Full Due to AlwaysDeleteColdPartitions=False
search cancel

CB Response: Disk Full Due to AlwaysDeleteColdPartitions=False

book

Article ID: 290627

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

/var/cb/data/solr5/cbevents filled up disk.

Environment

  • CB Response Server: 6.X

Cause

Set "AlwaysDeleteColdPartitions=False" in /etc/cb/cb.conf.

Resolution

Create a cron job to move all the cold partitions under /var/cb/data/solr5/cbevents to another storage.

Additional Information

1. The following command shows what partitions are currently mounted to SOLR:
curl "http://127.0.0.1:8080/solr/admin/cores?action=STATUS&wt=json&indexInfo=false&indent=true"
2. When setting ""AlwaysDeleteColdPartitions=False", cbevents purge job would only unmount partitions from SOLR, WITHOUT removing them.