Known Issues for NetWitness Export Connector

Title, Problem & Workaround Found In /
Exists In
Fixed Version Track-


NetWitness Export Connector

Title: Position tracking is not updated properly when query is used to filter the sessions.
Problem: Last aggregated is not updated to the latest aggregated ID but is updated only to the last filtered session retrieved. For Example, If a decoder has 1000 sessions, and only first 800 sessions match the filter, the in the position tracking shows 800 even though all 1000 sessions are processed. This does not cause any data loss but if the Logstash service is restarted, aggregation will begin from 801, processing the 200 sessions again.
Workaround: None



NetWitness Export Connector Title: Consumer does not consume all the events after the Logstash service is restarted.
Problem: While running at a high EPS or if there is a large session behind, the NetWitness Export Connector aggregates the sessions of the decoders. The Logstash pipeline sends to the output plugin which in turn sends it out to the consumer. At this point, if a Logstash service is stopped or restarted, the Logstash pipeline ensures the data is sent out of the output plugin to the consumer, however all the sessions are not consumed by the consumer. This leads to data loss on the consumer end even though Logstash has sent out all the data.
Workaround: Update the start_session parameter in the Logstash configuration file (netwitness-<decoder-ip>-input.conf) by referring to the latest received on Kafka or any other consumer used.
netwitness-export-connector-1.0.0 netwitness-export-connector-1.1.0 ASOC-102440
NetWitness Export Connector

Title: Position tracking not saved for some Decoder sources after sometime in a multiple sources configuration.

Problem: When aggregating data from multiple sources in a single Logstash instance, after a period of time, the position tracking thread fails for some or all of the sources gradually and stops tracking the position (bookmarking) for those sources.

Workaround: None




NetWitness Export Connector

Title: Unable to start session aggregation from of Decoder when it is not 1.

Problem: If the Decoder has the other than 1, which means the Decoder has data that has rolled over, the NetWitness Export Connector's start_session parameter will not start aggregation from that value, instead it would begin from the

Workaround: Add 1 to the value to the start_session parameter and the aggregation would start as expected dropping the first session only. For example, if on a Decoder is '1105000' add 1 to it and set the value of the start_session parameter as '1105001'.

netwitness-export-connector-1.0.0 netwitness-export-connector-1.1.0 ASOC-101951