Article Number
000001580
Applies To
RSA Product Set: ECAT, NetWitness Endpoint
RSA Product/Service Type: Server, SQL Database
RSA Version/Condition: 4.3.x, 4.4.x
Platform: Windows, Microsoft SQL Server
Issue
The RSA NetWitness Endpoint upgrade from 4.3.x is taking more than an hour to complete during the SQL update.
The installer program in Windows Task Manager shows that the program is "Not Responding."
The installer log file
"%temp%\Setup Log {date} #001.txt" does not show any error at the end of the file. It shows the SQL script
ECAT_DELTA_4304_LATEST.SQL is running and occasionally the log file is updated showing the line below, where the number [275] is line last updated and the result code [0] indicates there is no error.
sectionLine [275] Result [0]
Cause
There is a known issue where the
mocNetAddresses database table can grow to be very large and the database maintenance job doesn't delete the old records.
To confirm if a very large mocNetAddresses database table is the issue for the upgrade, run the SQL queries below in the
ECAT$PRIMARY database by selecting
New Query in SQL Server Management Studio.
- If the mocNetAddresses database table has 10s million rows marked to delete or over 80% of the rows in this database table are marked to delete, then the upgrade will be adversely extended.
USE ECAT$PRIMARY
GO
DECLARE @countOfAll FLOAT(8)
SELECT @countOfAll = COUNT(*) FROM mocNetAddresses
SELECT
COUNT(*) AS RowsMarkedToDelete, COUNT(*) / @countOfAll * 100 AS PercentMarkedToDelete
FROM mocNetAddresses
WHERE MarkedAsDeleted = 1
- If the mocNetAddresses database table has 10s million rows and uses 10s GB disk space then the upgrade will be adversely extended.
USE ECAT$PRIMARY
GO
sp_spaceused '[dbo].[mocNetAddresses]'
Resolution
The known issue referenced in this article has been permanently fixed in RSA NetWitness Endpoint version 4.4.0.2 and above.
Workaround
Depending on whether or not you will be upgrading to a fixed version in the short-term, there are two workarounds that can be performed to alleviate the issue until an upgrade can be performed.
Please
contact RSA Customer Support and reference this article and they will be able to assist in performing the appropriate workaround.