000038119 - RSA NetWitness Broker aggregation failed from concentrator due to pending queries

Document created by RSA Customer Support Employee on Nov 13, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000038119
Applies ToRSA Product Set: NetWitness Platform
RSA Product/Service Type: Core Appliance
RSA Version/Condition: 11.X
Platform: CentOS
O/S Version: 7
 
IssueBroker Aggregation from Concentrator shows "failed" status in Broker->Config->General tab.
 

/var/log/messages:
Nov  7 07:55:55 NwBroker NwBroker[14798]: [Bandwidth] [info] Performing bandwidth test to device 10.1.11.5:50005...
Nov  7 07:55:55 NwBroker NwBroker[14798]: [Bandwidth] [info] Received 25 MB at a transfer rate of 113.64 MB/sec or 953.3 Mbps from device '10.1.11.5:50005'
Nov  7 07:55:55 NwBroker NwBroker[14798]: [Aggregation] [info] Device '10.1.11.5:50005' is being initialized
Nov  7 07:55:55 NwBroker NwBroker[14798]: [Broker] [info] Local database found no sessions for device '10.1.11.5:50005'
Nov  7 07:55:55 NwBroker NwBroker[14798]: [Aggregation] [info] Device '10.1.11.5:50005' is querying for exact session time
Nov  7 07:55:55 NwBroker NwBroker[14798]: [Aggregation] [failure] Failed to initialize device '10.1.11.5:50005' because There are too many pending queries at this time, please resubmit the query later. Device aggregation is being stopped.
Nov  7 07:55:55 NwBroker NwBroker[14798]: [Device] [info] Device '10.1.11.5:50005' is coming online

 


 




 
CauseNavigating to Concentrator->Explore->sdk->stats page shows queries.pending as high as below.

pend
ResolutionPlease follow below steps to cancel pending queries.
  1. Login to Netwitness GUI and Navigate to Concentrator->Explore->sdk.
  2. Right-click on sdk to click properties.
  3. Select cancel from drop-down and options will be handle=<query_id> then click send.
    Note: <query_id> can be replaced with number under Concentrator->Explore->sdk->stats->queries by expanding +.
  4. 4. Response box shows the Success on successful cancellation of pending queries. 

Attachments

    Outcomes