Export more than 100,000 sessions

[Anonymous]

Hi,

How export more than 100,000 sessions from the Investigation>export menu on the web interface ?

Yohann,

[huanzhou1]

Not sure this can help or not, go to your profile settings, change the investigation threshold from 100,000 to bigger size.

[Anonymous]

Thanks! I changed this value in my profile (to 1,000,000 and the value is saved) and restarted the concentrator. Unfortunately, I still have the limitation of 100,000 for an export.

[RSAAdmin]

What do you want with an export this large?

[huanzhou1]

I tested, looks like export sessions more than 100,000 will fail. I tried to export 67,000 without any issue.

Job huan.7047878e-05f9-486d-8d26-bf7e702609f0 threw a JobExecutionException:

org.quartz.JobExecutionException: Error retrieving PCAP from device [See nested exception: java.io.IOException: com.rsa.netwitness.carlos.clients.nextgen.NextGenException: HTTP/1.1 401 Unauthorized]

  at com.netwitness.platform.server.investigation.common.export.jobs.ExtractInvestigationPcapJob.executeJob(ExtractInvestigationPcapJob.java:64)

  at com.rsa.netwitness.carlos.scheduling.jobs.AbstractJob.execute(AbstractJob.java:61)

  at org.quartz.core.JobRunShell.run(JobRunShell.java:213)

  at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:557)

Caused by: java.io.IOException: com.rsa.netwitness.carlos.clients.nextgen.NextGenException: HTTP/1.1 401 Unauthorized

  at com.rsa.netwitness.carlos.transport.nextgen.adapter.NextGenContentAdapter.handle(NextGenContentAdapter.java:363)

  at com.rsa.netwitness.carlos.transport.nextgen.adapter.NextGenContentAdapter.handle(NextGenContentAdapter.java:282)

  at com.rsa.netwitness.carlos.transport.nextgen.adapter.NextGenContentAdapter.handleRequestStream(NextGenContentAdapter.java:130)

  at com.rsa.netwitness.carlos.transport.nextgen.NextGenContentMessageChannel.requestStream(NextGenContentMessageChannel.java:42)

  at com.rsa.netwitness.carlos.transport.nextgen.NextGenContentMessageChannel.requestStream(NextGenContentMessageChannel.java:27)

  at com.rsa.netwitness.carlos.transport.spi.AbstractMessageChannel.requestStream(AbstractMessageChannel.java:149)

  at com.netwitness.platform.server.investigation.common.export.jobs.AbstractExtractionJob.getContentInputStream(AbstractExtractionJob.java:97)

  at com.netwitness.platform.server.investigation.common.export.jobs.AbstractExtractionJob.getPCAPContentInputStream(AbstractExtractionJob.java:84)

  at com.netwitness.platform.server.investigation.common.export.jobs.ExtractInvestigationPcapJob.executeJob(ExtractInvestigationPcapJob.java:60)

  ... 3 more

Caused by: com.rsa.netwitness.carlos.clients.nextgen.NextGenException: HTTP/1.1 401 Unauthorized

  at com.rsa.netwitness.carlos.clients.nextgen.impl.NextGenClientImpl.downloadContent(NextGenClientImpl.java:1912)

  at com.rsa.netwitness.carlos.transport.nextgen.adapter.NextGenContentAdapter.handle(NextGenContentAdapter.java:358)

  ... 11 more

[Anonymous]

I also set the session limit to 70,000 and it is not taken into account (still 100,000 results).

[Anonymous]

FYI, I only try to export raw logs (not PCAP).