Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Error: "Found multiple cores with the name"

EDR: Error: "Found multiple cores with the name"

Environment

  • EDR Server 6.1.2 and higher

Symptoms

  • EDR cluster does not start
  • /var/log/cb/solr/debug.log shows: 
    [ERROR] - from org.apache.solr.core.SolrCore in main null:org.apache.solr.common.SolrException:
    Found multiple cores with the name [cbevents_XXXXXXXXXXX], with instancedirs [/var/cb/data/solr5/cbevents/cbevents_YYYYYYYY] and [/var/cb/data/solr5/cbevents/cbevents_XXXXXXXX]

Cause

Known issue caused by low disk space or other factors resulting in a timeout. The event core file(s) are not updating their core.properties file as expected. 

Resolution

  1. Note the "cbevents_" file name in the error log. (cbevents_XXXXXXX)
  2. Edit /var/cb/data/solr5/cbevents/cbevents_XXXXXXX/core.properties 
  3. Change the following line... 
    name=cbevents_YYYYYYY
    to: 
    name=cbevents_XXXXXXX
The name parameter ("cbevents_XXXXXXX") should match the directory name that the core.properties files is located in.
  1. Repeat steps 1 and 2 for all duplicated directories. Each one should have a core.properties file with the proper "name" value. 
  2. Restart the server

Additional Notes

The writer core can also be seen with the same issue. Found multiple cores with the name [writer]. The same steps apply, however the latest core should still be have "name=writer" in the core.properties file.

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-21-2018
Views:
1621
Contributors