Watchlists appear in Error state

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Multiple watchlist in the UI show Error in the panel
• Toaster error when loading a watchlist: "Watchlist's execution failed due to an error. If this error persists, please consult Carbon Black Technical Support."
• Solr is performing high levels of garbage collection
• Restarting services resolves the issue temporarily

Environment

• EDR Server: All versions (formerly CB Response)
• EDR Cloud: 6.x

Cause

Server is not meeting OER standards for the amount of data coming through

Resolution

• Increase resources to the server to meet OER standards
• If too much data is coming in, reducing maximum event core size can also help https://knowledge.broadcom.com/external/article/289673/edr-how-to-adjust-maximum-solr-core-size.html