Article Number
000034489
Applies To
RSA Product Set: Security Analytics
RSA Product/Service Type: SA Security Analytics Server
RSA Version/Condition: 10.6.0 - 10.6.2
Issue
On the RSA Security Analytics server the Jetty web server will throw a NullPointerException if a feed file cannot be reached.
ERROR com.rsa.smc.sa.core.service.DefaultHttpClientService - https://ecatserverexported:9443/api/v1/feed/machines.csv
java.lang.Exception: Failed to access file.
This will impact performance on the RSA Security Analytics server.
In /var/lib/netwitness/uax/sa.log you will see:
Caused by: java.lang.NullPointerException
at com.rsa.smc.sa.live.job.quartz.RecurringFeedJob.getCsvOrFeedFile(RecurringFeedJob.java:350)
Resolution
This will be addressed in RSA Security Analytics version 10.6.3.
Workaround
Restart Jetty:
1. SSH as root in to your SA server
2. Run:
stop jettysrv
3. Run:
start jettysrv
Repair or remove the failed feed that cannot be accessible.
1. Click on Dashboards or Administration - Select Live and click on Feeds.
2. Check in the list of Feeds for the failed feed(s).
3. Use the select box to select the failed feed.
4. Click the edit icon and use the verify button to confirm the feed is accessible. If the feed is not accessible determine why the link to the feed is down or remove the feed by clicking on the minus delete button until you have resolved the location of the feed.
