Packet Concentrator not working

[Anonymous]

Jan 24 18:08:03 avsesa-rsasa-pkt-p01 nw[3057]: [Index] [failure] Unexpected Query Exception of type N5boost12interprocess22interprocess_exceptionE: Too many open files

Any ideas?  This is what happens when I try to use investigator.

[BrianHoward]

Yes, I am having issues with CentOS5 appliances.  I am patiently awaiting the upgrade path to OS6.

[RSAAdmin]

Okay, looks like you are missing the line. See my comment above and add it to your file(s).

Alternatively, you can do:

/usr/sbin/NwDecoder --uninstall

/usr/sbin/NwDecoder --install

For versions 10.3.1 and higher.

[BrianHoward]

Ok, I applied that to my CentOS5 based decoders and concentrators and it appears to have fixed my issue.  Thanks for the assist!

[Anonymous]

Yes, 10.3 Indexing is way different and on the log side the reindexing will take days on a large deployment.

Even in Development the system took over night to catch up after reindexing.

I'm concerned about my production environment where there is far much more data and potentially reindexing is going to take days?

[RSAAdmin]

Reindexing?  There's no reindexing needed when upgrading from 10.2 to 10.3.  There's a conversion process that takes a few minutes on a decoder and a few hours (at most, if it's really large) on a concentrator.

In a few isolated cases, especially in the case of a misconfigured index on a decoder, a reindex was required.  On a Decoder, this reindex takes a few hours.

[Anonymous]

I'm not talking packets. I specifically talking logs and yes the system took overnight to catch up.

And if you look at the concentrator through the config view you will see a huge backlog of meta that the concentrator must catch up on.

So, not sure what this exactly is?

It would be extremely helpful to explain this level of detail in the release notes.

For example, in 10.2 the indexing was changed for these reasons.