EDR: Error: "Found multiple cores with the name"

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• EDR cluster does not start
• /var/log/cb/solr/debug.log shows: 

  [ERROR] - from org.apache.solr.core.SolrCore in main null:org.apache.solr.common.SolrException:
  Found multiple cores with the name [cbevents_XXXXXXXXXXX], with instancedirs [/var/cb/data/solr5/cbevents/cbevents_YYYYYYYY] and [/var/cb/data/solr5/cbevents/cbevents_XXXXXXXX]

Environment

• EDR Server 6.1.2 and higher

Cause

Known issue caused by low disk space or other factors resulting in a timeout. The event core file(s) are not updating their core.properties file as expected. 

Resolution

1. Note the "cbevents_" file name in the error log. (cbevents_XXXXXXX)
2. Edit /var/cb/data/solr5/cbevents/cbevents_XXXXXXX/core.properties 
3. Change the following line... 
   name=cbevents_YYYYYYY
   to: 
   name=cbevents_XXXXXXX

The name parameter ("cbevents_XXXXXXX") should match the directory name that the core.properties files is located in. ​

1. Repeat steps 1 and 2 for all duplicated directories. Each one should have a core.properties file with the proper "name" value. 
2. Restart the server

Additional Information

The writer core can also be seen with the same issue. Found multiple cores with the name [writer]. The same steps apply, however the latest core should still be have "name=writer" in the core.properties file.