NetWitness Community

RomanZeltser · ‎2017-04-24

One of my Policy's rule for Log Decoder has triggered the Critical Error. Where do I adjust the size of the queue (if it is possible)? Or where do I clean the existing queue?

I am not sure it is related but my Concentrator shows the status: "Initializing Index" (instead of "Ready")

Thanks in advance.

EricPartington · ‎2017-04-24

This is the policy details for that log collector H&W alert

The Log Collector queue holding log events to be sent to the Log Decoder has exceeded 80%. This could be due to the Log Decoder not being able to keep up with the collection rate, the Log Decoder collection being disabled, or the Log Decoder service being down or otherwise non-functioning.

Possible Remediation Action:
1. Ensure the Log Decoder service is running.
2. Ensure collection is enabled on the Log Decoder.
3. Ensure collection counts are increasing on the Log Decoder.
4. Check the CPU utilization and Load avg on the Log Decoder appliance.

please check the 4 items listed here to validate they are not the issue.

RomanZeltser · ‎2017-04-24

Eric, thanks for suggestion. I have the CPU running at almost 100% constantly. What does it indicate?

===============

Roman Zeltser

Sr. IM Security Analyst

CDR Associates

307 International Circle

Suite 300

Hunt Valley, MD 21030

P: 410-560-2269 x.1261

rzeltser@cdrassociates.com<mailto:rzeltser@cdrassociates.com>

EricPartington · ‎2017-04-25

I would check the linerate coming into the log decoder/ collector to make sure its not pushing the appliance too hard.

I might track down the swapcheck.sh script and run that on the log decoder to see what services are consuming swap and go from there.

A support ticket will get you quicker assistance with this if you need it.

Eric

MihaMesojedec · ‎2017-04-25

Eric,

Where did you get swapcheck.sh script?

Miha

RomanZeltser · ‎2017-04-25

Guys, I have opened the new case about this issue. #00960936