Slow peformance on concentrator

[RSAAdmin]

Has anyone experienced an issue on the concentrator where it takes a long time for the values to appear on the page

for example when you select navigate followed by the time period you want to review the data for, the values used to appear on the screen quite quickly.

But recently when I try to bring up the values, its takes about 5 minutes for the values to appear and even then only about 40% of the values appear

I have cleared the internet history and re arranged the meta keys only selecting the main 5 values I review and closing the the values that I do not wish to see

But still I am getting a very slow performance - my network has been checked and there are no network issues that would cause the issue

[RSAAdmin]

You mentioned that you reduced the meta keys down to 5.  What are they specifically and are they configured for IndexKeys or IndexValues?

[huanzhou1]

still check the SDK - stats see any queries running or not. maybe your reports or alerts caused the problem.

[RSAAdmin]

Gr8ppl3r - I have reduced these to source country, source destination, threat description,service type and threat source They are configured for Index values

patriot3w - this may sound like a silly question as I am fairly new to netwitness - how do I check the SDK

[RSAAdmin]

Checking the SDK query status is an extremely important health check that an Administrator MUST know how to do (and frequent user for that matter).  Knowing how to quickly check the status of any given query is imperative to success in keeping the system running normally (and knowing how to resolve related 'issues' that come up).  Most often the case is not actually the system behaving poorly but rather that an under-experienced user has crafted something that has put extra stress on the system.

Since you mentioned that you are dealing with a Concentrator, you can get to these SDK query metrics by navigating to EXPLORER on the Concentrator itself.  You can do this through SA or via the Administrator thick client.  Once inside the Explorer view, expand 'sdk', then 'stats', then 'queries'.  If there are any running queries, they will show up here with a unique handle for each query. If you select a query, it will show you all of the pertinent information of that particular query (ex: 'query progress').  If you happen to have multiple queries, click through each one and observe the details of what is going on.  You may notice that a poorly constructed rule or alert is causing the system to work harder than it should. This is where it can become a challenge to manage the system if other users are not up-to-speed on formulating efficient queries / rules / alerts, etc.  This can become an ever greater challenge when you are dealing with multiple Concentrators and add in a Broker hierarchy as well (same health check process as mentioned before, just on more appliances).  It is manageable though! You just have to get comfortable doing these checks on a regular basis and before you know it you will be able to quickly diagnose a problem and start working towards a proper resolution.

As an Administrator, you'll want to learn how to view queries, kill individual queries, and how to perform other related health checks on an ad-hoc / routine basis.  There should be related documentation available to you either via the online Help docs, this Community, or possibly from your Account / Sales Engineering team. 

Hope this helps

[Anonymous]

The default value I had for max queries at one time was my main issue.  From what I can tell, everything is considered a query in the system so if you are running a report with a lot of queries it can eat your systems speed quickly.  I personally just set the max queries at 90 and so far I have not seen anything but extra speed in the system.

The one thing I am currently working with support on is the lack of speed to queries from the past.  If I want to look at an hour from March 25th, it takes close to an hour to load the values. 

[RSAAdmin]

Again, your slowness scenario could be due to a user input constraint somewhere in the system as I just ran a similar query (one hour period on Mar 25th) for a single Concentrator in my environment and the results came back extremely quick (2.75 secs).  This Concentrator is on 10.3.1

[Anonymous]

My query was for a single source IP.  Nothing more. 

[RSAAdmin]

We have seen those slowness issues every now and then. Sometimes queries come very quickly. I can basically search through anything within seconds. Currently we are having issues and we have seen this before. Simple queries take minutes to accomplish.

We noticed however that some "contains" queries and similar might take all the I/O resources from the disk containing the indexDB (iostat). That can then affect to the whole system. I wonder why there have so slow disks on those RSA appliances 7,5K rpm or something.

For instance currently our systems LogHybrids are working like in slow motion movies. I/O isn't the problem. We have had these issues from the beginning. Who knows why.. re-indexing the IndexDB helped at some point (we have created our own meta-fields etc. though).

I don't know if this has something to do with the issues, we have seen (from RSA SecurCare Online - KB):

a64807 | Log Decoder Partitions in Hybrid or AIO Appliance are Not Configured Correctly

[Anonymous]

I just looked at the article and my system appears to be configured wrong.  I will update my config and see if this works.