CB Response: Disk Full Due to AlwaysDeleteColdPartitions=False

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

/var/cb/data/solr5/cbevents filled up disk.

Environment

• CB Response Server: 6.X

Cause

Set "AlwaysDeleteColdPartitions=False" in /etc/cb/cb.conf.

Resolution

Create a cron job to move all the cold partitions under /var/cb/data/solr5/cbevents to another storage.

Additional Information

1. The following command shows what partitions are currently mounted to SOLR:

curl "http://127.0.0.1:8080/solr/admin/cores?action=STATUS&wt=json&indexInfo=false&indent=true"

2. When setting ""AlwaysDeleteColdPartitions=False", cbevents purge job would only unmount partitions from SOLR, WITHOUT removing them.