000037247 - RSA NetWitness Endpoint UI Cache Corruption / Admin Status Blank Description Field

Document created by RSA Customer Support Employee on Apr 8, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000037247
Applies ToRSA Product Set: NetWitness Endpoint
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.4.0.5-4.4.0.9
Platform: Windows

 
IssueUI cache corruption occurs during machine status assignment, causing the cache to become corrupted and messing with the visible machines list until the UI cache is deleted and regenerated.

  User-added image
CauseThis is caused by a UI code bug that is pulling the incorrect number of admin status columns from the SQL database, causing an extra 'empty' column to appear in the UI. When this column appears and is selected to clear the machines administrative status(which is typically why its chosen) it sends a broken UPDATE statement to SQL which then corrupts the UI's cache, until the cache is manually deleted.

  Status box showing the top box as blank in the Description field instead of a named field such as Infected
Resolution
  1. Deleting the UI cache will resolve this issue until the next crash is encountered. The immediate workaround is awareness: do not select the blank field seen in the Machine Admin status column. This should allow for normal work to take place, always select a status that has a named description in the drop down box:
    Status box showing the top box as blank in the Description field instead of a named field such as Infected
  2. This issue will be permanently in a later version, currently slated for 4.4.0.10

Attachments

    Outcomes