IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

EDR: How to Troubleshoot Watchlist Errors

EDR: How to Troubleshoot Watchlist Errors

Environment

  • EDR Server: All Supported Versions

Objective

 How to Troubleshoot Watchlist Errors

Resolution

  1. Try restarting the EDR cb-enterprise services to rectify the Watchlist error.
  2. If still receiving the same error, try disabling and re-enabling the Watchlist.
  3. Make note of any other console issues that may be symptoms of a larger issue.
  4. Check the /var/log/cb/job-runner/jog-runner.log for the Watchlist name, to see if other errors are present at that time.
  5. Check the /var/log/cb/solr*/debug.log and startup.log to look out for errors at the time of reproducing this issue.
  6. If none of the above helped, upload cbdiags to alliance.

Additional Notes

  • If the issue is happening on a specific Watchlist, disable the current Watchlist and create a new Watchlist with the same query as well as notification settings.
  • If Solr cores are not optimizing, the server may not be meeting the Operating Environment Requirements standards for the amount of data coming through, slowing down any requests to the database.
  • Resources are needed to meet Operating Environment Requirements standards, to prevent future occurrences of this issue.
  • If too much data is coming in, reducing maximum event core size can also help.
     

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎12-13-2023
Views:
248
Contributors