Access official resources from Carbon Black experts
Version
Cb Response v6.x.
Issue
Cb Response server fails to start (standalone or cluster environment). Starting process hangs on 'Starting cb-solr' while 'Waiting for cb-solr to build the terms dictionary'.
Starting cb-solr: [ OK ]
Waiting for cb-solr to build the terms dictionary.
Depending on index size this may take a while.............................
<May return to command prompt without error>
Symptoms
Following message is found in '/var/log/cb/solr/debug.log' file:
[ERROR] - from org.apache.solr.core.SolrCore in main
null:org.apache.solr.common.SolrException: Found multiple cores with the name [writer], with instancedirs [cbevents_<timestamp1>] and [cbevents_<timestamp2>]
Cause
Known issue related to a failure in the Solr event core rollover, discussed in the following document: Cb Response startup fails
Per the referenced document, 'This is due to a rare issue with Solr core rollover identified as CB-13790. This defect is scheduled to be addressed in the next product release (currently targeted for: 6.1.2). For this issue specifically there are two 'writer' cores. Normally there is only one 'writer' core, and it should be the core with the most recent timestamp.
Solution
Running the command from Step 1a in the referenced document will identify the 'writer' core, in this case there will be two:
$ find /var/cb/data/solr5/cbevents -type f -exec grep -H 'name=writer' {} \;
./cbevents_2017_09_04_2003/core.properties:name=writer
./cbevents_2017_07_28_1615/core.properties:name=writer
Perform following steps to remove the oldest of the two 'writer' cores:
1) From the find command above, unload the oldest 'writer' core:
(Warning: Alerts generated from process data in this core will lead to 404 pages)
curl "http://localhost:8080/solr/admin/cores?action=UNLOAD&core=cbevents_2017_07_28_1615"
2) Verify the core is unloaded:
curl "http://localhost:8080/solr/admin/cores?action=STATUS&indexInfo=true&indent=true&wt=json" | grep cbevents_2017_07_28_1615
3) Remove the directory when core is no longer loaded
rm -rf /var/cb/data/solr5/cbevents/cbevents_2017_07_28_1615
4) Restart cb-enterprise services (or cbcluster restart)
Related Content
Copyright © 2005-2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.