Hello, when I run at autopsy, prompt solr keyword service error, when I select and check the keyword search plugins to continue running, which was a mistake, cause the whole are not running, as shown in the figure below and don’t know how to solve
Hello.
What version of Autopsy are you running? Years ago I recall there being a similar issue for users that were using foreign languages or had non-Latin characters in their paths. I’m wondering if you are running into that if you are running an older Autopsy?
Hello,thank you for your reply.
I am running autospy 4.13.0, my autopsy path is D: \ Autopsy-4.13.0, I tried to use the multi-user function, but after installing solr according to the autopsy document, the keyword search error occurs in autospy Question, how can I solve it.
Thanks one more!
If your Solr server is running on a different machine it could be that a firewall is preventing Autopsy from communicating with Solr.
Confirm that you can connect to it using a web browser on the Autopsy machine. The URL will look like http://machine-name:8983/solr/#
There should also be indications of whats causing the issue in the Autopsy logs. Take a look at the autopsy.log files in the %APPDATA%\autopsy\var\log and your case folder (e.g. F:\autopsy test\33\Log).
I can successfully connect to 8983/solr/#, and 23232/solr/#, so I don’t know what’s wrong. The following are some of my copied log informatio：
`Solr Keyword Search Service failed to open case resources for 333
java.util.concurrent.ExecutionException: org.sleuthkit.autopsy.appservices.AutopsyService$AutopsyServiceException: Failed to open or create core for F:\autopsy test\333
autopsy.appservices.AutopsyService$AutopsyServiceException: Failed to open or create core for F:\autopsy test\333
org.apache.solr.client.solrj.SolrServerException: Server refused connection at: http://localhost:23232/solr/333_20200110_111345_20200110_111350
java.util.concurrent.FutureTask.report(FutureTask.java:122)
INFO: Running Solr command: [F:\autopsy\autopsy13\jre\bin\java, -Xmx512m, -DSTOP.PORT=34343, -Djetty.port=23232, -DSTOP.KEY=jjk#09s, -jar, start.jar, --stop]
2020-01-10 15:22:46.859 org.sleuthkit.autopsy.keywordsearch.Server runSolrCommand
INFO: Finished running Solr command
2020-01-10 15:22:46.859 org.sleuthkit.autopsy.keywordsearch.Server stop
INFO: Waiting for Solr server to stop
2020-01-10 15:22:49.273 org.sleuthkit.autopsy.keywordsearch.Server stop
INFO: Finished stopping Solr serve `
Is your Solr server running on the same machine as Autopsy or a different machine?
How have you configured your multi user settings? A screenshot would be useful.
FYI: Single user cases use a local Solr instance that runs on port 23232. Multi user cases typically connect to a network based Solr instance that listens on port 8983 by default. Your multi user settings should be configured to use the network based Solr instance.
The network based Solr instance needs to be able to write to the location where your case output is being stored. This is typically accomplished by using a UNC path as your case output folder (e.g. \servername\autopsy test).
Another thing to check is the Logging tab in the Solr web UI. If your problem is being caused by Solr’s inability to access your case output folder there should be a log message there.