EDR: Only one active Solr core/shard mounted

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Server Dashboard page shows only 1 shard
• /var/cb/data/solr*/cbevents shows multiple cores, but older cores are missing a cb.core.properties file
• Disk usage of /var/cb/data/ exceeds MaxEventStoreSizeInPercent in /etc/cb/cb.conf

Environment

• EDR Server: All Versions
• Cold storage enabled

Cause

Cold cores are taking up too much space causing any warm cores to roll over immediately. 

Resolution

• Remove cold cores from the partition
• Increase disk size

Additional Information

• It is not recommended that cold cores be stored on the /var/cb partition
• New cores can be remounted manually, but the cb.user_mounted file will need to be removed: How to remount Solr Cold Core Partitions