000037098 - Log Decoder service continuously respawning/restarting with "trap divide error" after upgrading to RSA NetWitness Logs & Packets 11.2

Document created by RSA Customer Support Employee on Jan 14, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000037098
Applies ToRSA Product Set: NetWitness Logs & Packets
RSA Product/Service Type: Core Appliance, Log Decoder
RSA Version/Condition: 11.2
IssueThe Log Decoder service is continuously respawning/restarting with "trap divide error" after upgrading to 11.2.

The following log can be seen in the messages log file:

Sep 13 13:59:50 xxxxxxxxxx kernel: [47805.493874] traps: service listen[19342] trap divide error ip:895907 sp:7fa23dffa7b0 error:0 in NwLogDecoder[400000+162b000]


 
CauseIf the "save.session.count" parameter of the Logdecoder configuration is set to "auto", it raises an arithmetic exception due to a "divide by zero" condition.
 
ResolutionThis is issue has been permanently fixed on 11.2.0.1 and later.
 
WorkaroundA temporary workaround is to set "save.session.count" to a value different than "auto" in the Explore view:

User-added image

Attachments

    Outcomes