IPDB extractor initialization error in RSA Security Analytics 10.5.x and unable to start

[#1]

Article Number

000032554

Applies To

RSA Product Set: Security Analytics
RSA Product/Service Type: SA IPDB Extractor
RSA Version/Condition: 10.5.x
Platform: CentOS
O/S Version: 6
 

Issue

Envision package has been installed to IPDBExtractor properly and still get an "Initialization Error" on the IPDBExtractor >View >System screen, and unable to Start Extractor.

Image description

And /var/log/messages has following error in regards to IPDBExtractor:

Nov 10 12:40:48 xxxxx NwIPDBExtractor[23892]: [Engine] [warning] Module ipdbextractor failed to load. Diagnostic information: Throw location unknown (consider
using BOOST_THROW_EXCEPTION)Dynamic exception type: boost::exception_detail::clone_impl >std::exception::what: use_certificate_chain_file: no start line  

 

Cause

The cert file used by IPDBExtactr service is not correct and need to be changed.

Resolution

To change IPDBExtractor service cert file, follow the steps below.

1) Open IPDBExtractor service Explorer view
2) Browse to ipdbextractor > config
3) Check certificate.filePath setting
4) Change certificate.filePath to /etc/netwitness/ng/ipdbextractor_cert.pem if it is not.
5) Restart nwipdbextractor service, ex. #restart nwipdbextractor

Image description