IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

EDR: How To Use a Symlinked Location for Event Storage

EDR: How To Use a Symlinked Location for Event Storage

Environment

  • EDR Server: 6.X and higher

Objective

To  use a symlinked location for event storage

Resolution

1. Create a mount point in another location in the file system, such as /data2.
2. Create a symlink to the cbevents* directory inside the solr* directory that points to the mounted directory. For example:

  • ln -s /data2 /var/cb/data/solr/cbevents2

Note: depending on if you upgraded from an older version, it may be under solrN directory like the below example. Check for recent cbevents/cbevents_<date> to confirm which is correct. 

  • ln -s /data2 /var/cb/data/solr6/cbevents2

3. Ensure that the Cb Response user has write permissions in the mounted directory (/data2).


Additional Notes

Please note that there is no need to mkdir /var/ cb /data/solr5/cbevents2.


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-24-2018
Views:
772
Contributors