This section describes the data storage settings in the cb.conf file. AllianceClientStorefilePurgeMaxThis parameter specifies the maximum number of storage files (binaries uploaded from sensors to the server) that the Carbon Black EDR Alliance client purges from a local hard drive, if it determines that the files should be deleted. AllianceClientNoStorefileDeleteThis parameter specifies if the Carbon Black EDR Alliance client should keep binary files locally after they are uploaded to the central Carbon Black EDR Alliance server. AlwaysDeleteColdPartitionsThis parameter controls the handling of cold (unmounted) partitions, including partitions that are unmounted due to conditions defined by other parameters in cb.conf . CbSolrConnectionTimeoutThis parameter sets the connection timeout from the Solr backend engine to the datastore in milliseconds. CbSolrSocketTimeoutThis parameter sets the socket read timeout from the Solr backend engine to the datastore in milliseconds. DatastoreBroadcastEventTypesThis setting is deprecated. Use the EnableRawSensorDataBroadcast setting instead. DatastoreLogMaxHistoryThis parameter sets the maximum number of days to keep datastore debug logs. DatastoreLogMaxFileSizeThis parameter sets the maximum allowable file size of a single debug log file. DatastoreLogTotalSizeCapThis parameter sets the maximum allowable disk space of all datastore debug logs. DatastoreRootDirThis parameter sets the path to the root directory where runtime data for the Carbon Black EDR server is stored. EnableExtendedApiAuditLoggingWhen this parameter is set to True (enabled), Carbon Black EDR logs all REST API requests from either the console or other sources, such as scripts, and stores the data in /var/log/cb/audit/useractivity.log. EnableRawSensorDataBroadcastThis parameter determines how the data store publishes to the message bus. EnableSolrBinaryInfoNotificationsWhen set to True , this parameter enables notifications for binaries that are entirely new to Carbon Black EDR, or new to specific sensor hosts or sensor groups. EnableSolrFeedNotificationsWhen set to True , this parameter enables notifications when documents that register as feed hits are committed to the Solr index. KeepAllModuleFilesThis setting enables or disables the deletion of binary files that sensors upload. MaxCbLoggingMessageSizeThis parameter configures the maximum syslog message size (in bytes) for cb-enterprise log output under /var/log/cb. MaxEventStoreDaysThis parameter controls how old warm (mounted) partitions can get before they are unmounted or deleted. MaxEventStoreSizeInDocsThere is no longer an absolute event core size in docs. MaxEventStoreSizeInMBBy default, process data is purged automatically when disk space is required. If this parameter value is set, process data is unmounted or deleted, starting from the earliest date, until the size of the process store is less than the value. MaxEventStoreSizeInPercentThis value determines the percentage of total disk space that can be taken up by the event store before cleanup is triggered. MaxSearchResultRowsThis parameter configures the maximum number of search result rows to display in the console per page. MaxSyslogSenderMessageSizeThis parameter configures the maximum syslog message size (in bytes) for cb-enterprise syslog notifications. MinAvailableSizeInMBThis parameter sets a lower limit on the available disk space that must be maintained on the mount point where the event store resides. ProcessDocumentSplitThresholdRemoved in 6.1. PruneIndividualDocumentsByTimeThis parameter controls whether individual documents are pruned if their age exceeds the MaxEventStoreDays setting. SolrLogMaxFileSizeThis parameter sets the maximum allowable file size of a single debug log file. SolrLogMaxHistoryThis parameter sets the maximum number of days to keep Solr debug logs. SolrLogTotalSizeCapThis parameter sets the maximum allowable disk space of all Solr debug logs. SolrOptimizationSkipOnWriterVolumeIf set to True, the system never optimizes the partition on the volume that is currently being written to. SolrOptimizeHourThis setting controls when Solr optimization is done (in local time). SolrTimePartitioningActivePartitionsThis setting controls the number of actively searched Solr partitions that remain in the query index. SolrTimePartitioningDailyStartTimeThis setting controls the time partitioning for Solr collections by specifying a daily start time. SolrTimePartitioningFreeSpaceThresholdPercIf there are multiple event storage volumes, event storage switches to a different volume when the threshold for the percent of remaining space is reached. SolrTimePartitioningMaxSizeMBThis parameter sets a maximum size (MB) for partitions, after which a new partition is started. SolrTimePartitioningMinutesThis setting controls the time partitioning for Solr collections, in minutes per partition. SolrTimePartitioningOptimizeMaxSegmentsThis setting controls the maximum number of segments used to optimize warm partitions. WatchlistEndTimeOffsetReplaced by WatchlistEndTimeOffsetSeconds. WatchlistEndTimeOffsetSecondsChanges the search window end-time offset (in seconds) for watchlist search jobs. WatchlistStartTimeOffsetReplaced by WatchlistStartTimeOffsetSeconds. WatchlistStartTimeOffsetSecondsThis parameter specifies the search window start-time offset in seconds for watchlist search jobs.
