IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

How To Purge Cbmodule Data

How To Purge Cbmodule Data

Warning: This will irrecoverably remove data from the Cb Response server. After removing this data, you will receive a 404 page when attempting to view binary details pages older than MaxEventStoreDays and this data will no longer appear in the Binary Search

Version

Cb Response 5.x, 6.1

Topic

This will purge cbmodule data from the solr database located at /var/cb/data/solr5/cbmodules/ (for 5.x this is located at /var/cb/data/solr/cbmodules/).

Solution

Binary (meta)data

  1. Determine MaxEventStoreDays setting in /etc/cb/cb.conf as a starting point to purge to:
    grep MaxEventStoreDays /etc/cb/cb.conf
  2. Run this curl command replacing XX with MaxEventStoreDays. If additional space need to be recovered, reduce this purge time:
    Warning: Binaries older than this set value will lead to 404 pages
    curl http://127.0.0.1:8080/solr/cbmodules/update?commit=true -H "Content-Type: text/xml" -d "<delete><query>last_seen:[* TO NOW-XXDAYS]</query></delete>"
    Warning: This will prevent alerts on feeds with score changes from this past data.

Related Solutions

How to automate this process: How To Enable Automated Cbmodule Purging

Warning: cbmodules is not the same as the modulestore files that are the binaries themselves. Here is how you purge this data: How To Purge Storefile (Modulestore Binary) Data

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎07-27-2017
Views:
1518
Contributors