Help, ¿Could not close case resources for sole keyword?..
Due to an energy problem, my laptop turned off and now my case won’t open
I suspect that your issue is the result of Autopsy (and Solr) being abruptly terminated.
When Solr is not shut down cleanly it leaves behind a “core.properties” file for the case which can cause problems when you subsequently attempt to open the case.
Try the following:
- Ensure that Autopsy is shut down.
- Find the “core.properties” file. The location of the file depends on your platform and where you installed Autopsy.
If you are on Windows and you installed Autopsy to the default location (i.e. C:\Program Files) you should be able to find the file under %APPDATA%\autopsy\solr<casename>\core.properties. - Delete the “core.properties” file.
- Restart Autopsy and open the case.
Hey Downey,
I run into the same problem and i was sure your fix would solve it for me however i cannot locate the core.properties file in the location you suggested. My installation is running on windows with default settings
When you create a new case do you see a new folder with your case name in %APPDATA%\autopsy\solr?
If the answer is no it suggests that the “core.properties” file is being created in a different location and I recommend searching your drive for “core.properties”.
If the answer is yes it suggests you are having a different issue. In that case I recommend looking at the log files in %APPDATA%\autopsy\var\log for errors.
Hi there!
I have run into the same problem. I got the Error:“Could not close case resources for Solr Keyoword Search Service service: java.lang.NullPointerException”.
I have deleted “core.proberties” but the problem still exists.
The log-file looks like this:
SEVERE: Solr Keyword Search Service service failed to open case resources
java.util.concurrent.ExecutionException: java.lang.NullPointerException
java.util.concurrent.FutureTask.report(FutureTask.java:122)
java.util.concurrent.FutureTask.get(FutureTask.java:192)
org.sleuthkit.autopsy.casemodule.Case.closeAppServiceCaseResources(Case.java:2637)
org.sleuthkit.autopsy.casemodule.Case.close(Case.java:2585)
org.sleuthkit.autopsy.casemodule.Case.open(Case.java:1995)
org.sleuthkit.autopsy.casemodule.Case.lambda$doOpenCaseAction$6(Case.java:1847)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
Maybe someone has any suggestions?
Thanks…
Hi Downey,
It would appear that no folder with my case name is being created in %APPDATA% hence no solrcore.properties file. I did do a search for the core.properties and could not locate it in C.
However in my second partition, where my case is located there is a SolrCore.properties file inside the solr folder. But it does not have similar contents as displayed in this case Keyword Ingest module failure, therefore i doubt that what I am looking at is what you are referring to. I have uploaded a snippet of the content of that file.
I even tried uninstalling and deleting all leftover autopsy folders in program files and %APPDATA% but after reinstallation and trying to simply open a new case, i run into the same error.
Thanks for your help.
@Jfawkes You are correct. The SolrCore.properties file in the case output folder is not the one I was referring to.
When you start Autopsy are you able to connect to http://localhost:23232/solr in a web browser? If so, click on the Logging link on the left hand side and let me know if there are errors.
Here’s the error displayed at the logging tab for http://localhost:23232/solr
Well that is definitely a problem. Solr should not be trying to save the core.properties file to “C:\Program Files”. It’s failing to write to that location.
As a workaround try installing Autopsy to someplace other than “Program Files”.
Cool. Will let you know how it goes
I take it back. I see the same Solr error message about failing to write to C:\Program Files but it does not effect my ability to open a case.
Haha Got any more ideas?
I would suggest trying to reproduce by creating a new test case that doesn’t require redacting and getting all of the log files to us. If you are willing to do that I can send you a link to a location where you can upload them.
Yes i’m willing, please share the link.
For future reference, the issue that @Jfawkes was having was the result of a web proxy preventing Autopsy from communicating with the local Solr server.
1 Like
Thanks for the help resolving my issue
Thank u so much for taking time to help.