Error occurred while fetching data from source

[GayathriPulla]

Hi All, 

I am getting the following error while I run the reporter on Archiver. 

Error details : Message summary was not recognized by /sdk.

I think the issue is with Archiver itself as I am able to successfully get the report from Concentrator.

Please any one suggest if anybody faced this kind of issue

[SravanKoneti1]

Hi Gayathri,

I believe that searched data was not written to Archiver during that time. 

Can you please check /var/netwitness/archiver/database0/default/index directory to see exact date managed-values-* and verify the required meta values available within that.

If exists, can you try restarting nwarchiver after stopping Archiver aggregation.

[GayathriPulla]

Hi Sravan, 
There exists no path as you mentioned.

I have checked in the /var/netwitness/archiver/database0/all data/index --- where the data upto oct is present Also, when I checked checked the Packetdb file, I can see index files in the format as below and upto oct itself but I am running a report from Nov and dec

Files in packetdb:

Files in Metadb:

Files in Index:

Please suggest.

[SravanKoneti1]

Hi Gayathri,

Thank you for more details. Please check if you have more Index directories under /var/netwitness/archiver/database1 or /var/netwitness/archiver/database2 (these will be available when more DAC's connected to Archiver).

If no other index files to see Nov/Dec Indexing, you may need to investigate if indexing available for recent data. Please check this by going https://<SAserver IP>/investigation/<Archiver Device ID>/navigate/values for last 5 mins.

Reference on this url:Investigate: View and Modify Queries Using URL Integration 

If you see values only for October data, Please get it investigated why the indexing stopped.

Since Archiver packetdb,metadb has Dec data, you can regenerate the indexing again. But this is very time consuming. 

[GayathriPulla]

Hi Sravan, 

Now the report has completed with out any error and also I can see the values the on the link:  https://<SAserver IP>/investigation/<Archiver Device ID>/navigate/values for the Nov and Dec data.
But I haven't done any change to troubleshoot the same, the files in index are still the same