Article Number
000034084
Applies To
RSA Product Set: Security Analytics, NetWitness Logs and Packets
RSA Product/Service Type: Core Appliances
Platform: CentOS
Issue
When trying to override a meta key format by editing in the
index-concentrator-custom.xml or
index-broker-custom.xml files,
nwconcentrator and
nwbroker fails to start. and logs the below error message,
Example:Want to change the meta key
orig_ip format from
Text to
IPv4,
The original line in the
index-concentrator.xml and/or
index-broker.xml looks:
"<key description="Originating IP Address" level="IndexValues" name="orig_ip" format="Text"/>"
Added the below line in
index-concentrator-custom.xml or
index-broker-custom.xml,
"<key description="Originating IP Address" level="IndexValues" name="orig_ip" format="IPv4"/>"
Restart
nwbroker and/or
nwconcentrator services on the appliances.
# restart nwbroker or # restart nwconcentrator
The below error message appears:
Sep 23 16:18:11 p-rich-sa02c NwConcentrator[3171]: [Engine] [failure] Module concentrator failed to load: Diagnostic information: Throw in function nw::LanguageTokenPtr nw::Language::addToken(const nw::LanguageKey&, NwVariantFormat, const string&, nw::LanguageToken::TokenLevel, nw::uint32, nw::uint32, nw::uint32, nw::uint32)Dynamic exception type: boost::exception_detail::clone_implstd::exception::what: Cannot override format for orig_ip from Text to IPv4. Format changes are not allowed.[boost::errinfo_at_line_*] = 98
Sep 23 16:18:11 p-rich-sa02c NwConcentrator[3171]: [Engine] [failure] Module concentrator failed to load: Cannot override format for orig_ip from Text to IPv4. Format changes are not allowed.
Cause
Format attribute cannot be overridden in custom file.
Resolution
To overcome this issue, When updating the Format attribute it will have to be done in the
index-concentrator.xml and/or
index-broker.xml instead of
index-concentrator-custom.xml or
index-broker-custom.xml.Then restart the
nwbroker and/or
nwconcentartor services normally.
# restart nwbroker or # restart nwconcentrator
Note that these changes will be overwritten during the rebuilding, reinstall and upgrades, so it's very recommended to keep track of the changes done to these files.
Notes
Note that these changes will be overwritten during the rebuilding, reinstall and upgrades, so it's very recommended to keep track of the changes done to these files.
