EDR: SolrCore 'reader' is not available due to init failure

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Unable to collect process document:

"error":{
    "metadata":[
      "error-class","org.apache.solr.core.SolrCoreInitializationException",
      "root-error-class","org.apache.solr.core.SolrResourceNotFoundException"],
    "msg":"SolrCore 'reader' is not available due to init failure: Could not load conf for core reader: Error loading solr config from /var/cb/data/solr/cbevents/reader/conf/solrconfig.xml",
    "trace":"org.apache.solr.core.SolrCoreInitializationException: SolrCore 'reader' is not available due to init failure: Could not load conf for core reader: Error loading solr config from /var/cb/data/solr/cbevents/reader/conf/solrconfig.xml\n\

 

• Solr debug logs report:
  

[ERROR] - from org.apache.solr.servlet.HttpSolrCall in qtp294658299-69087 []
org.apache.solr.core.SolrCoreInitializationException: SolrCore 'reader' is not available due to init failure: Could not load conf for core reader: Error loading solr config from /var/cb/data/solr/cbevents/reader/conf/solrconfig.xml

Environment

• EDR(Formerly Carbon Black Response) Server: All Supported Versions

Cause

• core.properties file missing under /var/cb/data/solr/cbevents/reader
• core.properties file has been corrupted.

[example ]# cat core.properties 
Vim: Error reading input, exiting...
Vim: Finished.
2 files to edit
[root@localhost Desktop]#

Resolution

1. If the file has been corrupted, delete the existing /var/cb/data/solr/cbevents/reader/core.properties file.
2. Create a new core.properties file under /var/cb/data/solr/cbevents/reader/ 

   • touch core.properties

3. Set following parameters: by editing the file 

   • #Written by <Author> 
     #<Current Date> 
     name=reader 
     configSet=cbevents_v2

4. Save the file.
5. Change ownership of the file to cb:cb 

   • chown cb:cb  core.properties

6. Change permissions of the file to -rw-r--r--

• chmod 644 core.properties