|Applies To||RSA Product Set: NetWitness Platform|
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 10.6.x
O/S Version: 6
|Issue||Concentrator service is unable to start throwing core files under /var/netwitness/concentrator/metadb.|
Tried to move the core files from the metadb folder and start concentrator service but it doesn't work with new core files.
From /var/log/messages, you may observe the following messages "nwconcentrator process ended" after the index warning, [Index] [warning] Key ipv6.dst is missing from the most recent slice of 4800 …
NwConcentrator: [Index] [info] Indexes are being initialized
NwConcentrator: [Index] [info] Checking integrity of slice 4800
NwConcentrator: [Network] [info] Accepting connection from trusted peer 127.0.0.1 with subject name CN = 2851ae89-7577-41fe-bfba-1cd7346c2cff
NwConcentrator: [Engine] [audit] User admin (session 421, 127.0.0.1:49868) has logged in
NwConcentrator: [Index] [warning] Key ipv6.dst is missing from the most recent slice of 4800, but was found in slice 4799. This is most likely caused by an index configuration change.
init: nwconcentrator main process (20178) killed by ABRT signal
init: nwconcentrator main process ended, respawning
NwConcentrator: [meta] [warning] There are core files taking up 41.46 GB on the partition /var/netwitness/concentrator/metadb. Please open a support ticket to troubleshoot.
|Cause||For some reason, index slice was broken or corrupted due to unexpected service stop or Filesystem issue.|
|Workaround||You can try those steps as a workaround.|
After a period of time for index initializing, you are able to start concentrator service without any issue.
Note: If this workaround doesn't work, please contact customer support with core files and stack trace output.