Failed to retrieve meta keys

[Anonymous]

After tried add custom meta keys and duplicate exist in index-concentrator.xml meta key device.ip to index-concentrator-custom.xml with level="IndexKeys" I receive error at Investigation tab "Failed to retrieve meta keys". In System tab concentrator - Initialization Error. When try manual Start Aggregation:

Aggregation failed to start.:

Internal Server Error

The server encountered an internal error: _aggregator

Maybe somebody know how recovery concentrator?

[huanzhou1]

can share your index-concentrator-custom.xml? did you put the full xml syntax?

[Anonymous]

Now:

<key description="Vulnerability Name" format="Text" level="IndexValues" name="vuln.name" valueMax="256" />

<key description="Vulnerability Severity"  format="Init16" level="IndexValues" name="vuln.sev" valueMax="10" />

<key description="CVE ID" format="Text" level="IndexValues" name="cve.id" valueMax="256" />

Concentrator die after:

<?xml version="1.0" encoding="utf-8"?>

<language level="IndexNone" defaultAction="Auto">

<key description="Device IP" level="IndexKeys" name="device.ip" format="IPv4" valueMax="100000" defaultAction="Open"/> <key description="Vulnerability Name" format="Text" level="IndexValues" name="vuln.name" valueMax="256" />

<key description="Vulnerability Severity"  format="Init16" level="IndexValues" name="vuln.sev" valueMax="10" />

<key description="CVE ID" format="Text" level="IndexValues" name="cve.id" valueMax="256" />

</language>

I try use blank index-concentrator-custom.xml, but this not help me too.

[huanzhou1]

31560	2014-Apr-05 01:04:04	Engine	warning	Module concentrator failed to load: Language key vuln.sev in file '/etc/netwitness/ng/index-concentrator-custom.xml' has undefined format
31561	2014-Apr-05 01:04:04	Engine	warning	Module concentrator failed to load: Diagnostic information: Throw in function static void nw::LanguageManager::loadLanguageExtensions(const string&, nw::LanguagePtr) Dynamic exception type: nw::Exception std::exception::what: Language key vuln.sev in file '/etc/netwitness/ng/index-concentrator-custom.xml' has undefined format [boost::errinfo_at_line_*] = 523

[huanzhou1]

try to change:

<key description="Vulnerability Severity"  format="UInt16" level="IndexValues" name="vuln.sev" valueMax="10" />

[Anonymous]

For me help only:

<key description="Vulnerability Severity"  format="Text" level="IndexValues" name="vuln.sev" valueMax="10" />

My problem - I tried use different format for optimizing stored, but not come back to text format.

[huanzhou1]

so after you changed, everything is working?

[Anonymous]

Yes, thank you for helping. But open question - what format preferred to stored digital?