Article Number
000039670
Applies To
RSA Product Set: RSA NetWitness Platform
RSA Product/Service Type: Concentrator, Decoder, Log Decoder, Broker, Archiver.
RSA Version/Condition: 11.5.x
Platform: CentOS
O/S Version: 7
Issue
After upgrading the NetWitness environment, concentrator services fail to start the aggregation.
Failures like the below example are logged in
/var/log/messages.
Apr 27 01:00:00 concentrator NwConcentrator[18030]: [Aggregation] [failure] Failed to initialize device '10.10.10.11:50004' because Invalid language key name 'custom.sample-key', must start with an alpha, then follow with alphanumeric OR . OR _. Device aggregation is being stopped.
Checking
/etc/netwitness/ng/index-concentrator-custom.xml confirms that the problematic meta key is incorrectly formatted.
e.g. custom.sample-key
Cause
Due to the meta key format verification added to 11.5, if a meta key is defined in an unsupported format, the concentrator/archiver/broker and decoder services is expected to fail to start the aggregation or capture.
Resolution
In order to resolve the issue, please review the following files and modify all custom meta keys to start with an alpha, and contain alphanumeric, (.), (_) only and has a maximum length of 16 characters.
Concentrators -
/etc/netwitness/ng/index-concentrator.xml
/etc/netwitness/ng/index-concentrator-custom.xml
Packet Decoders -
/etc/netwitness/ng/index-decoder.xml
/etc/netwitness/ng/index-decoder-custom.xml
Log Decoders -
/etc/netwitness/ng/envision/etc/table-map.xml
/etc/netwitness/ng/envision/etc/table-map-custom.xml
/etc/netwitness/ng/index-logdecoder.xml
/etc/netwitness/ng/index-logdecoder-custom.xml
Broker -
/etc/netwitness/ng/index-broker.xml
/etc/netwitness/ng/index-broker-custom.xml
Archiver -
/etc/netwitness/ng/index-archiver.xml
/etc/netwitness/ng/index-archiver-custom.xml
In addition, update the affected custom keys in custom feeds and parsers if exist.
In case the decoder/logdecoder has unconsumed data which was captured before the upgrade, you may need to modify 'Aggregate Hours' from the downstream concentrator's Config page to skip the sessions which contain the problematic sessions.
e.g. If the decoder was upgraded at 5 AM and the current time is 10 AM, 'Aggregate Hours' can be set to 5 to aggregate only the sessions which are captured after the upgrade.
