Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Solr unable to start due to IndexFormatTooOldException

EDR: Solr unable to start due to IndexFormatTooOldException

Environment

  • EDR(Formerly Carbon Black Response) Server: All Supported Versions

Symptoms

  • Solr unable to start
  • Error in /var/log/cb/solr/debug.log
[ERROR] - from org.apache.solr.servlet.HttpSolrCall in qtp572868060-23 []
null:org.apache.solr.core.SolrCoreInitializationException: SolrCore 'cbmodules' is not available due to init failure: Error opening new searcher
 
Caused by: org.apache.lucene.index.IndexFormatTooOldException: Format version is not supported (resource BufferedChecksumIndexInput(MMapIndexInput(path="/var/cb/data/solr5/cbevents/cbevents_2021_10_13_1519/data/index/segments_9y"))): 0 (needs to be between 1071082519 and 1071082519). This version of Lucene only supports indexes created with release 6.0 and later.


 

Cause

  • Solr Index corruption.

Resolution

  • To delete the index, move `/var/cb/data/solr/cbmodules/data/index` to `/var/cb/data/solr/cbmodules/data/index_back`
  • Restart EDR services

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-09-2021
Views:
164
Contributors