RSA NetWitness Endpoint upgrade from 4.3.x is taking too long to complete

[#1]

Article Number

000001580

Applies To

RSA Product Set: ECAT, NetWitness Endpoint
RSA Product/Service Type: Server, SQL Database
RSA Version/Condition: 4.3.x, 4.4.x
Platform: Windows, Microsoft SQL Server

Issue

The RSA NetWitness Endpoint upgrade from 4.3.x is taking more than an hour to complete during the SQL update.

The installer program in Windows Task Manager shows that the program is "Not Responding."

The installer log file "%temp%\Setup Log {date} #001.txt" does not show any error at the end of the file. It shows the SQL script ECAT_DELTA_4304_LATEST.SQL is running and occasionally the log file is updated showing the line below, where the number [275] is line last updated and the result code [0] indicates there is no error.

sectionLine [275] Result [0]

Cause

There is a known issue where the mocNetAddresses database table can grow to be very large and the database maintenance job doesn't delete the old records.

To confirm if a very large mocNetAddresses database table is the issue for the upgrade, run the SQL queries below in the ECAT$PRIMARY database by selecting New Query in SQL Server Management Studio.

• If the mocNetAddresses database table has 10s million rows marked to delete or over 80% of the rows in this database table are marked to delete, then the upgrade will be adversely extended.

  USE ECAT$PRIMARY
  GO
  DECLARE @countOfAll  FLOAT(8)
  SELECT @countOfAll = COUNT(*) FROM mocNetAddresses
  SELECT
  COUNT(*) AS RowsMarkedToDelete, COUNT(*) / @countOfAll * 100 AS PercentMarkedToDelete
  FROM mocNetAddresses
  WHERE MarkedAsDeleted = 1

• If the mocNetAddresses database table has 10s million rows and uses 10s GB disk space then the upgrade will be adversely extended.

  USE ECAT$PRIMARY
  GO
  sp_spaceused '[dbo].[mocNetAddresses]'

Resolution

The known issue referenced in this article has been permanently fixed in RSA NetWitness Endpoint version 4.4.0.2 and above.

Workaround

Depending on whether or not you will be upgrading to a fixed version in the short-term, there are two workarounds that can be performed to alleviate the issue until an upgrade can be performed.
 
Please contact RSA Customer Support and reference this article and they will be able to assist in performing the appropriate workaround.