Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

How To Purge Cbmodule Data

How To Purge Cbmodule Data

Warning: This will irrecoverably remove data from the Cb Response server. After removing this data, you will receive a 404 page when attempting to view binary details pages older than MaxEventStoreDays and this data will no longer appear in the Binary Search

Version

Cb Response 5.x, 6.1

Topic

This will purge cbmodule data from the solr database located at /var/cb/data/solr5/cbmodules/ (for 5.x this is located at /var/cb/data/solr/cbmodules/).

Solution

Binary (meta)data

  1. Determine MaxEventStoreDays setting in /etc/cb/cb.conf as a starting point to purge to:
    grep MaxEventStoreDays /etc/cb/cb.conf
  2. Run this curl command replacing XX with MaxEventStoreDays. If additional space need to be recovered, reduce this purge time:
    Warning: Binaries older than this set value will lead to 404 pages
    curl http://127.0.0.1:8080/solr/cbmodules/update?commit=true -H "Content-Type: text/xml" -d "<delete><query>last_seen:[* TO NOW-XXDAYS]</query></delete>"
    Warning: This will prevent alerts on feeds with score changes from this past data.

Related Solutions

How to automate this process: How To Enable Automated Cbmodule Purging‚Äč

Warning: cbmodules is not the same as the modulestore files that are the binaries themselves. Here is how you purge this data: How To Purge Storefile (Modulestore Binary) Data

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎07-27-2017
Views:
1280
Contributors