Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

CB Response: How To Purge CbEvent (Process) Data in 5.x

CB Response: How To Purge CbEvent (Process) Data in 5.x


  • CB Response Server: 5.x


How to purge event process data from the Solr database in CB Response 5.x


  Services need to be running in order for this command to work. You can run this command for a minute to free enough space for services to start: How To Purge Storefile (Modulestore Binary) Data

  1. Determine MaxEventStoreDays setting in /etc/cb/cb.conf as a starting point to purge
grep MaxEventStoreDays /etc/cb/cb.conf
  1. Determine the cbevent shards (ProcSolrShards) that are present on the local server
cat /etc/cb/cbcluster.conf
  1. Run the following command, replacing XX with MaxEventStoreDays and SHARD with any shards that are present on the local server. If additional space needs to be recovered, reduce this purge time. This query selects all data older than XX days and deletes it. This command may take a while to complete. Solr will return a response when the purge is done
curl -H "Content-Type: text/xml" -d "<delete><query>last_server_update:[* TO NOW-XXDAYS]</query></delete>"


Additional Notes

Please open a support case if Solr is taking over an hour to return

Related Content

Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Creation Date: