| Article Number | 000033925 |
| Applies To | RSA Product Set: Netwitness
RSA Product/Service Type: Core appliances
RSA Version/Condition: 10.X
Platform: CentOS |
| Issue | When trying to manually roll-out data using the below steps it fails.
Sessiondb on log decoder as an example:
- Log into the SA GUI.
- Click on Administration -> Services.
- Select the log decoder service and Choose View -> Explore.
- In the right-side pane, right-click on database and select Properties, select it will open a pane in the bottom
- In the bottom-pane choose sizeRoll and
- In the parameters box, enter the following: type=session maxSize="required size MB" <- (Ex: 30000 MB)
Sometimes the above commands fail with Error Message:
Failed to process message sizeRoll for /database com.rsa.netwitness.carlos.transport.TanportException:
Size roll operation aborted because the requested maximum hot tier size of "value" is less than half of the
current warm tier usage of "value".
figure (1)
figure (2) |
| Cause | SA doesn't allow to manually roll-out more than half of the database size. |
| Resolution | Decrease the capacity of where the database is stored so it will automatically delete the old data.
- Log into the SA GUI.
- Click on Administration -> Services.
- Select the log decoder service and Choose View -> Explore.
- In the right-side pane, Open database tree and choose config.
- Jump to session.dir "take note of the current value" and change the value to the "needed value"
It should automatically start deleting the old data. - check /var/log/messages.
Once the delete is completed, follow the same above steps and revert back the session.dir to the old value noted in point 5.
figure (3)
figure (4)
If you are unsure of any of the steps above, contact RSA Support and quote this article for additional assistance. |
on Jul 10, 2019
