000033925 - Size roll for core appliances' database fails with error 'com.rsa.netwitness.carlos.transport.TanportException: Size roll operation aborted" in RSA Netwitness 10.x

Document created by RSA Customer Support Employee on Jul 10, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000033925
Applies ToRSA Product Set: Netwitness
RSA Product/Service Type: Core appliances
RSA Version/Condition: 10.X
Platform: CentOS
IssueWhen trying to manually roll-out data using the below steps it fails.

Sessiondb on log decoder as an example:
  1. Log into the SA GUI.
  2. Click on Administration -> Services.
  3. Select the log decoder service and Choose View -> Explore.
  4. In the right-side pane, right-click on database and select Properties, select it will open a pane in the bottom
  5. In the bottom-pane choose sizeRoll and 
  6. In the parameters box, enter the following:  type=session maxSize="required size MB" <- (Ex: 30000 MB)

Sometimes the above commands fail with Error Message:
 

Failed to process message sizeRoll for /database com.rsa.netwitness.carlos.transport.TanportException:
Size roll operation aborted because the requested maximum hot tier size of "value" is less than half of the
current warm tier usage of "value".




User-added image
figure (1) 

User-added image
figure (2) 
CauseSA doesn't allow to manually roll-out more than half of the database size.
ResolutionDecrease the capacity of where the database is stored so it will automatically delete the old data.
  1. Log into the SA GUI.
  2. Click on Administration -> Services.
  3. Select the log decoder service and Choose View -> Explore.
  4. In the right-side pane, Open database tree and choose config. 
  5. Jump to session.dir "take note of the current value" and change the value to the "needed value"
    It should automatically start deleting the old data. - check /var/log/messages.

Once the delete is completed, follow the same above steps and revert back the session.dir to the old value noted in point 5.
User-added image
figure (3)


User-added image


figure (4)

If you are unsure of any of the steps above, contact RSA Support and quote this article for additional assistance.

Attachments

    Outcomes