search
cancel
Search
CB Response: Disk Full Due to AlwaysDeleteColdPartitions=False
book
Article ID: 290627
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Show More
Show Less
Issue/Introduction
/var/cb/data/solr5/cbevents filled up disk.
Environment
CB Response Server: 6.X
Cause
Set "AlwaysDeleteColdPartitions=False" in /etc/cb/cb.conf.
Resolution
Create a cron job to move all the cold partitions under /var/cb/data/solr5/cbevents to another storage.
Additional Information
1. The following command shows what partitions are currently mounted to SOLR:
curl "http://127.0.0.1:8080/solr/admin/cores?action=STATUS&wt=json&indexInfo=false&indent=true"
2. When setting ""AlwaysDeleteColdPartitions=False", cbevents purge job would only unmount partitions from SOLR, WITHOUT removing them.
Feedback
thumb_up
Yes
thumb_down
No