> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/troubleshooting/the-connection-to-apache-solr-in-the-enginsight-siem-keeps-dropping-what-can-i-do.md).

# The connection to Apache Solr in the Enginsight SIEM keeps dropping. What can I do?

The SIEM Index Server in Enginsight is based on Apache Solr and is the primary database for the SIEM. It indexes logs and makes them easy to search.

If your Enginsight setup experiences an issue where the connection to Apache Solr works intermittently and then drops again, there may be several possible causes.

In this article, we will show you what you should check to identify the issue and how to resolve it.

***

## Using a Proxy

If you use a proxy, you should check the following to rule out the proxy as the cause of requests to Apache Solr being blocked:

### 1. Add the IP address to the proxy whitelist

Apache Solr sends HTTP requests to itself via the IP address for the SIEM Index Server that is specified in the Docker configuration file. To ensure that these requests are not blocked by your proxy, you must explicitly add this IP address to the proxy whitelist.

Therefore, check whether the `NO_PROXY` parameter is correctly set in all required places in your proxy configuration and whether the corresponding IP address is included there.

### 2. Configure the proxy environment in Docker

The proxy environment must be explicitly configured on the SIEM Management Server, the SIEM Index Server, and in the Docker containers `solr`, `loggernaut`, and `traicer`.

Check whether all configuration adjustments have been made accordingly and whether the proxy has been configured correctly.

{% hint style="success" icon="lightbulb" %}
For more information on which configuration adjustments you need to make when using a proxy, see the Knowledge Base: [What configuration adjustments do I need to make in Enginsight if I use a proxy?](/docs/knowledge-base/english/configuration/what-configuration-adjustments-do-i-need-to-make-in-enginsight-if-i-use-a-proxy.md)
{% endhint %}

***

## Using a Hardened DNS

Apache Solr performs a reverse DNS lookup on the target IP address during HTTP requests to determine the corresponding hostname. If you use a hardened DNS (Domain Name System), such requests may be detected as malicious and blocked.

In this case, you can restrict Solr's reverse DNS lookup to the host itself and thereby prevent your DNS from blocking the connection.

Follow these steps:

{% stepper %}
{% step %}
Log in to the **SIEM Index Server**.
{% endstep %}

{% step %}
Open the Docker configuration file `docker-compose.yml` using the following command:

```
sudo nano /opt/enginsight/enterprise/docker-compose.yml
```

{% endstep %}

{% step %}
Adjust the Docker configuration as follows:

<pre><code>version: '3'
services: 
    solr: 
        restart: always 
        image: solr:${SOLR_VERSION}
<strong>        networks:
</strong><strong>            solrnet
</strong><strong>        extra_hosts:
</strong><strong>            - "docker-gateway:172.18.0.1" 
</strong>        ports: 
            - &#x3C;SIEMIndexServerIPAddress>":8983:8983" 
        volumes: 
            - /var/solr:/var/solr/data 
        environment: 
            - ZK_HOST=&#x3C;SIEMManagementServerIPAddress>:2181 
            - SOLR_HOST=&#x3C;SIEMIndexServerIPAddress> 
            - SOLR_OPTS=-XX:G1HeapRegionSize=32M -Dpkiauth.ttl=5000 -Dsolr.log.level=WARN 
            - SOLR_JAVA_MEM=-Xms&#x3C;40%_RAM_GB>g -Xmx&#x3C;50%_RAM_GB>g 
        command: solr -f -cloud

<strong>networks:
</strong><strong>    solrnet:
</strong><strong>        driver: bridge
</strong><strong>        ipam:
</strong><strong>            driver: default
</strong><strong>            config:
</strong><strong>                - subnet: 172.18.0.0/16
</strong><strong>                  gateway: 172.18.0.1
</strong></code></pre>

{% hint style="warning" %}
**Please note**: If specifying the subnet causes issues because it conflicts with an existing Docker network, adjust the gateway IP address accordingly, for example `172.19.0.1` instead of `172.18.0.1`.
{% endhint %}
{% endstep %}

{% step %}
Save the changes to the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}
Now restart Solr with the new settings using the following command:

```
sudo docker compose -f /opt/enginsight/enterprise/docker-compose.yml up -d --force-recreate
```

{% endstep %}
{% endstepper %}

***