503 Error with message 'No record found for selection of trigger' in RSA NetWitness

[#1]

Article Number

000017462

Applies To

RSA Product Set: Security Analytics, RSA NetWitness Platform
RSA Product/Service Type: RSA NetWitness

Issue

Error message "No record found for selection of trigger" in RSA NetWitness.
503 error is displayed in the browser when attempting to access the NetWitness UI.

An error message similar to the following is displayed in /var/netwitness/uax/log/sa.log:

java.lang.IllegalStateException: No record found for selection of Trigger with key:
'DEFAULT.864f3ac8-3f5c-45d4-9314-1c4f9924bb9a' and statement: SELECT * FROM QRTZ_SIMPLE_TRIGGERS WHERE
SCHED_NAME = 'org.springframework.scheduling.quartz.SchedulerFactoryBean#0' AND TRIGGER_NAME = ? AND
TRIGGER_GROUP = ?
at
org.quartz.impl.jdbcjobstore.SimpleTriggerPersistenceDelegate.loadExtendedTriggerProperties(SimpleTriggerPersistenceDelegate.at org.quartz.impl.jdbcjobstore.StdJDBCDelegate.selectTrigger(StdJDBCDelegate.java:1801)
at org.quartz.impl.jdbcjobstore.JobStoreSupport.retrieveTrigger(JobStoreSupport.java:1520)
... 60 more

Cause

This issue is caused when Quartz falls into an inconsistent state.

Resolution

In order to resolve the issue, the trigger in question needs to be removed from the database.  The trigger that is causing the error will be displayed after the word DEFAULT in the error message, as shown in red above.  In this example, the trigger name is 864f3ac8-3f5c-45d4-9314-1c4f9924bb9a.  This name will be referred to as <triggerName> in the steps below.

To remove the trigger from the Quartz database, connect to the RSA NetWitness Admin Server host via SSH and issue the following commands:

1. systemctl stop jetty
2. cd /var/lib/netwitness/uax/db
3. cp platform.h2.db platform.h2.db.backup
4. wget https://repo1.maven.org/maven2/com/h2database/h2/1.3.172/h2-1.3.172.jar
5. java -cp h2-1.3.172.jar org.h2.tools.Shell -url jdbc:h2:file:platform

the following commands above will connect you to SQL database then you need to issue the following SQL commands

1. sql> DELETE FROM QRTZ_TRIGGERS WHERE JOB_NAME = '<triggerName>';
         e.g. DELETE FROM QRTZ_TRIGGERS WHERE JOB_NAME = '864f3ac8-3f5c-45d4-9314-1c4f9924bb9a';
2. sql> DELETE FROM QRTZ_JOB_DETAILS WHERE JOB_NAME = '<triggerName>';
         e.g. DELETE FROM QRTZ_JOB_DETAILS WHERE JOB_NAME = '864f3ac8-3f5c-45d4-9314-1c4f9924bb9a';
3. sql > quit

Note: on each of the proceeding commands the output will be similar to the following:
(Update count: 1, 5 ms)
The key being that 1 record was updated with each command.

Now restart Jetty with the following command:  systemctl start jetty

 If you are unsure of the steps above or encounter issues, contact RSA Support and quote this article ID for further assistance. 

Notes

For Security Analytics 10.x, please use the following file and commands instead.
wget https://repo1.maven.org/maven2/com/h2database/h2/1.2.147/h2-1.2.147.jar
java -cp h2-1.2.147.jar org.h2.tools.Shell -url jdbc:h2:file:platform

stop jettysrv
start jettysrv