Corrupt or incomplete HTML session during event reconstruction on RSA Netwitness

[#1]

Article Number

000034792

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics UI
RSA Version/Condition: 10.5.x, 10.6.x
 

Issue

When attempting to view larger sessions the images are not rendering, instead during event reconstruction we see a corrupt or incomplete session and the text content limited:

Image description

You will see something similar to this in /var/lib/netwitness/uax/sa.log on the Security Analytics server:

INFO  com.rsa.smc.sa.investigation.reconstruction.domain.builder.ContentBuilder - 
ContentBuilder#stageBuild: reached max packet limit 100 for session 1672351202; 
stopping reconstruction

 

Cause

The session has reached the max packet limit for the session. Limits on the number of packets per session is configured by default to enhance performance in multi-user environments where reconstruction of events are frequently being accessed.

Resolution

Adjust the event reconfiguration settings according to your environment and resources to render the full session.

This can be configured from RSA Security Analytics:

1. Click on Administration from RSA Security Analytics

2. Select System

3. From the left pane click on Investigation

4. Click on the Events tab

5. Scroll down to the Reconstruction Events Settings and adjust these settings to meet the needs and resources for your environment.

Image description
As a reference the configuration for these settings are defined in the document below:
https://community.rsa.com/docs/DOC-62379